# Why your OpenVAS PDF report is missing CVEs (and how to fix it)

**The short version:**

- The classic Greenbone PDF format summarizes results and can leave out CVE details that XML and CSV include.
- The report filter, especially Quality of Detection (QoD), decides which results appear at all.
- Export the XML report for anything you will hand to a client or process with a tool.
- Many Greenbone checks have no CVE at all; that is Unknown, not clean.

## The symptom

You run a scan in Greenbone Community Edition or a Greenbone appliance, download the PDF, and the report shows hosts and result summaries but few or no CVE identifiers. Sometimes the totals at the top count critical results that never appear in the tables below. Both problems come up repeatedly on the Greenbone community forum, and both have ordinary causes.

## Cause 1: the PDF format leaves details out

Greenbone generates reports through report formats. The long-standing PDF format is built for a human-readable summary and is not where Greenbone puts its maintenance effort; forum maintainers have confirmed that it can omit CVE details the other formats include. The XML, CSV and TXT formats carry the full reference list for each result.

> **Fix** Download the report as **XML**. It is Greenbone's native format and holds every field: the NVT OID, severity, QoD, references (CVE, CERT-Bund, DFN-CERT), detection details and the solution. Use the PDF only as a quick visual check.

## Cause 2: the report filter hides results

Every Greenbone report is generated through a results filter. The default filter typically includes `min_qod=70`, which hides results whose Quality of Detection is below 70 percent. QoD expresses how reliable the detection method is: a remote banner check scores lower than an authenticated package check. Filters can also apply severity thresholds, a row limit (`rows=`) or hide overridden results.

- Open the report in the web interface and look at the filter string before downloading.
- Lower or remove `min_qod` if you need the complete picture, then label low-QoD results as lower-confidence in your report.
- Remove the row limit so large reports are not truncated.
- Check whether overrides or false-positive markings changed severities.

## Cause 3: the check has no CVE

Many Greenbone NVTs test for things that never received a CVE: deprecated TLS versions, weak SSH algorithms, default credentials, end-of-life operating systems, exposed services. Those results are real findings with an OID and a severity but an empty CVE list. A report that counts only CVE-backed findings will under-report them.

Varaxon Scan Hub reports CVE-based assessment for those findings as **Unknown** rather than zero, and can optionally map Greenbone OIDs to CVEs on the server where a reliable mapping exists. Either way the gap stays visible.

## A checklist before you send a Greenbone report

1. Confirm the scan used credentials for the hosts where you expect local checks.
2. Check the filter: QoD threshold, severity threshold, row limit, overrides.
3. Download the XML report.
4. Compare the result count in the XML with the count shown in the web interface.
5. State in the report which results have no CVE and how they were prioritized.

Upload the XML to Varaxon Scan Hub to get a prioritized, client-ready report from it. The [Greenbone / OpenVAS page](https://varaxontech.com/openvas-vulnerability-reports?utm_source=hashnode-blog&utm_medium=referral&utm_campaign=openvas-report-missing-cves) and its sample report show the result.

## Common questions

**What does QoD mean in OpenVAS?**

QoD, Quality of Detection, is a percentage expressing how reliable a detection method is. Authenticated package checks score high; remote banner checks score lower. Report filters often hide results below a QoD of 70.

**Which OpenVAS report format includes CVEs?**

The XML report format includes every result with its full reference list, including CVEs. CSV and TXT also include CVE references. The classic PDF format can omit them.

---

*This guide first appeared on [varaxontech.com](https://varaxontech.com/guides/openvas-report-missing-cves).*

I'm building [Varaxon Scan Hub](https://varaxontech.com?utm_source=hashnode-blog&utm_medium=referral&utm_campaign=openvas-report-missing-cves). It turns exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp, Defender and other network, host and web scanners into clear, client-ready reports, and can open HaloPSA or ConnectWise tickets after you review them. Your first three reports are free, and a free pre-flight check shows what it can read from your export first.

— Brandon Sooknanan  
Founder, Varaxon Technologies