SBOM reported vulnerabilities are overwritten

### Current Behavior

Hi guys,

I am working for a company with a programming language and am currently working on a package manager. As such I wanted to add SBOM support. I create my own PURLs which might not be valid yet and as such used generic in this case. All working fine.

Just the one issue that when I allow the OSS scanner to fetch vulnerabilities from the SBOM it seems very aggressive in searching for corresponding CVEs. To me the idea is that an SBOM can provide vulnerabilities if it actually got the info from somewhere or is sure it's the case which in this case I am doing.

With the SBOM below it just found a to me random CVE that has nothing to do with it. The only reason I found why it matched is because the package name is "toast". It seems to me that in this manner you literally destroy the evidence it provides and provide a false positive.

I understand that finding corresponding CVEs is needed and is to enrich. I think in this case it's better to provide an additional if so/duplicate vulnerability that is a false positive instead of overwriting the reported one.

Lemme know if I am doing something wrong. Other web tools did report them correctly even though I am still testing out the evidence I can provide.

Sincerely,

P.S. Tried both the lastest version as well as the snapshot from docker hub.

### Steps to Reproduce

`{
"bomFormat": "CycloneDX",
"components": [
{
"bom-ref": "local/DateTime",
"group": "local.DateTime",
"name": "DateTime",
"purl": "pkg:system/local/DateTime",
"type": "library",
"version": ""
},
{
"bom-ref": "github.com/DataFlex-dev/Security.git/Library/DFSecurity-CNG/DFSecurity-CNG-25.0",
"externalReferences": [
{
"comment": "DFPkg upstream repository for: DataFlex-dev/DFSecurity-CNG-25.0",
"type": "distribution",
"url": "https://github.com/DataFlex-dev/Security.git"
}
],
"group": "com.github.DataFlex-dev.DFSecurity-CNG-25.0",
"manufacturer": {
"name": "DataFlex-dev"
},
"name": "DataFlex-dev/DFSecurity-CNG-25.0",
"purl": "pkg:generic/github.com.DataFlex-dev/DFSecurity-CNG-25.0@1.0.0#Library/DFSecurity-CNG/DFSecurity-CNG-25.0.sws",
"supplier": {
"name": "github.com",
"url": [
"https://github.com/DataFlex-dev/Security.git"
]
},
"type": "library",
"version": "1.0.0"
},
{
"bom-ref": "DataFlex-dev/Toast",
"externalReferences": [
{
"comment": "DFPkg upstream repository for: DataFlex-dev/Toast",
"type": "distribution",
"url": "https://packages.dataflex.dev/api/v1/packages/DataFlex-dev/Toast"
}
],
"group": "dev.dataflex.packages.DataFlex-dev.Toast",
"manufacturer": {
"name": "DataFlex-dev"
},
"name": "DataFlex-dev/Toast",
"purl": "pkg:generic/packages.dataflex.dev.DataFlex-dev/Toast@0.1.1",
"supplier": {
"name": "packages.dataflex.dev",
"url": [
"https://packages.dataflex.dev/api/v1/packages/DataFlex-dev/Toast"
]
},
"type": "library",
"version": "0.1.1"
},
{
"bom-ref": "local/DFSecurity-25.0",
"group": "local.DFSecurity-25.0",
"name": "DFSecurity-25.0",
"purl": "pkg:system/local/DFSecurity-25.0",
"type": "library",
"version": ""
},
{
"bom-ref": "local/ChartLibrary",
"group": "local.ChartLibrary",
"name": "ChartLibrary",
"purl": "pkg:system/local/ChartLibrary",
"type": "library",
"version": ""
},
{
"bom-ref": "local/Conversions",
"group": "local.Conversions",
"name": "Conversions",
"purl": "pkg:system/local/Conversions",
"type": "library",
"version": ""
},
{
"bom-ref": "local/DataFlex Reports Demo Library",
"group": "local.DataFlex-Reports-Demo-Library",
"name": "DataFlex Reports Demo Library",
"purl": "pkg:system/local/DataFlex-Reports-Demo-Library",
"type": "library",
"version": ""
}
],
"dependencies": [
{
"dependsOn": [
"DataFlex-dev/Toast",
"github.com/DataFlex-dev/Security.git/Library/DFSecurity-CNG/DFSecurity-CNG-25.0",
"local/ChartLibrary",
"local/Conversions",
"local/DataFlex Reports Demo Library",
"local/DateTime"
],
"ref": "WebOrderMobile"
},
{
"dependsOn": [],
"ref": "local/DateTime"
},
{
"dependsOn": [
"local/DFSecurity-25.0"
],
"ref": "github.com/DataFlex-dev/Security.git/Library/DFSecurity-CNG/DFSecurity-CNG-25.0"
},
{
"dependsOn": [],
"ref": "DataFlex-dev/Toast"
},
{
"dependsOn": [],
"ref": "local/DFSecurity-25.0"
},
{
"dependsOn": [],
"ref": "local/ChartLibrary"
},
{
"dependsOn": [],
"ref": "local/Conversions"
},
{
"dependsOn": [],
"ref": "local/DataFlex Reports Demo Library"
}
],
"metadata": {
"component": {
"bom-ref": "WebOrderMobile",
"name": "WebOrderMobile",
"type": "application",
"version": ""
},
"timestamp": "2026-02-13T18:42:32Z",
"tools": {
"components": [
{
"authors": [
{
"email": "info@dataaccess.eu",
"name": "Data Access Europe B.V.",
"phone": "+31 74 255 56 09"
}
],
"bom-ref": "DataFlex Command Line Interface 0.0.1",
"copyright": "Copyright (c) 2005-2026 Data Access Worldwide. All rights reserved.",
"hashes": [
{
"alg": "BLAKE2b-256",
"content": "6b6e6b4a7569653658412f51545456674d6e785a34344a457142557a65314944"
}
],
"licenses": [
{
"license": {
"acknowledgement": "concluded",
"name": "License supplied by DataFlex"
}
}
],
"manufacturer": {
"contact": [
{
"email": "info@dataaccess.eu",
"name": "Data Access Europe B.V.",
"phone": "+31 74 255 56 09"
}
],
"name": "Data Access Worldwide",
"url": [
"https://dataflex.dev"
]
},
"name": "DataFlex Command Line Interface 0.0.1",
"scope": "optional",
"supplier": {
"contact": [
{
"email": "info@dataaccess.eu",
"name": "Data Access Europe B.V.",
"phone": "+31 74 255 56 09"
}
],
"name": "Data Access Worldwide",
"url": [
"https://dataflex.dev"
]
},
"type": "application",
"version": "0.0.1"
}
]
}
},
"serialNumber": "urn:uuid:f3f25a21-d0f0-43dd-911a-f699b26215b6",
"specVersion": "1.6",
"version": 1771008152,
"vulnerabilities": [
{
"affects": [
{
"ref": "DataFlex-dev/Toast",
"versions": [
{
"version": "0.1.1"
}
]
}
],
"analysis": {
"response": [
"update"
],
"state": "exploitable"
},
"created": "2026-02-13T18:42:32Z",
"description": "something",
"id": "vulnerability-for-DataFlex-dev/Toast",
"published": "2026-02-13T18:42:32Z",
"ratings": [
{
"justification": "Failed to check for updates for dependency: DataFlex-dev/Toast, error: 22",
"method": "CVSSv2",
"score": 5,
"severity": "medium",
"source": {
"name": "DFPkg",
"url": "https://packages.dataflex.dev/api/v1/packages/DataFlex-dev/Toast"
}
}
],
"source": {
"name": "DFPkg",
"url": "https://packages.dataflex.dev/api/v1/packages/DataFlex-dev/Toast"
}
}
]
}`

### Expected Behavior

Expected that if it cannot find the CVE-${num} string directly or whatever other notation it should add it additionally instead of replacing the reported vulnerability. Better a false positive than a disappearing vulnerability.

### Dependency-Track Version

4.13.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported