DependencyTrack / DependencyTrack/dependency-track
Vulnerability database total count does not visibly change despite successful ingestion of new advisories
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency-Track continuously mirrors and ingests new vulnerability/advisory data successfully, but the total vulnerability count displayed in the UI remains static for long periods.
### Steps to Reproduce
1.Example:
* Total vulnerability count remains:
`723815`
Even after:
* successful NVD mirroring
* successful EPSS sync
* new MAL advisories inserted
* new Debian advisories inserted
## Evidence
Mirror logs show successful ingestion:
```text
[NistApiMirrorTask] Mirroring of 14219 CVEs completed
```
Database verification confirms new/updated records are actively inserted:
```sql
SELECT MAX("UPDATED") FROM "VULNERABILITY";
2026-05-13 04:22:27.057+00
```
Recent entries:
```text
MAL-2026-3633
DEBIAN-CVE-2026-5342
```
### Expected Behavior
One of the following should be clarified/improved:
1. UI count should visibly reflect newly inserted advisories/vulnerabilities
2. Documentation should clarify that:
* many mirror operations update existing records in-place
* total counts may remain stable
* advisories are deduplicated/merged
3. Dashboard should expose:
* newly inserted count
* updated count
* merged/deduplicated count
### Dependency-Track Version
4.14.2
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
17
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.