diff --git a/src/pkg/scan/whitelist/manager.go b/src/pkg/scan/whitelist/manager.go
index d582e3f10..2d244bdb2 100644
--- a/src/pkg/scan/whitelist/manager.go
+++ b/src/pkg/scan/whitelist/manager.go
@@ -41,6 +41,7 @@ type defaultManager struct{}
 func (d *defaultManager) CreateEmpty(projectID int64) error {
 	l := models.CVEWhitelist{
 		ProjectID: projectID,
+		Items:     []models.CVEWhitelistItem{},
 	}
 	_, err := dao.CreateCVEWhitelist(l)
 	if err != nil {
@@ -66,6 +67,9 @@ func (d *defaultManager) Get(projectID int64) (*models.CVEWhitelist, error) {
 		log.Debugf("No CVE whitelist found for project %d, returning empty list.", projectID)
 		return &models.CVEWhitelist{ProjectID: projectID, Items: []models.CVEWhitelistItem{}}, nil
 	}
+	if wl.Items == nil {
+		wl.Items = []models.CVEWhitelistItem{}
+	}
 	return wl, err
 }