CVE data for /cve-update (optisigns yocto_os). One folder per delivery, named by its date.

nvd/<YYYY-MM-DD>/   NVD database (Yocto nvdcve_2-2.db, zstd -19), as of that day (UTC).
                    .date = exact data time, .sha256 = of the uncompressed database,
                    .zst.sha256 = of the download. Published by s0_mirror.py publish-nvd.
nvd/LATEST          the newest folder.
vendor/<vendor>/<YYYY-MM-DD>/   a vendor bulletin delivery (e.g. Rockchip's CVE zip), dated by receipt.
vendor/<vendor>/LATEST          the newest folder.

Nothing else lives directly in this folder.