Generic CPE check possible? (e.g. for checking other project's resources like nginx, etc.)

Is it possible to add a list of generic CPE entries to let dependency-check check other resources from the project for security leaks?

Like other software used in the project like:
* nginx
* apache
* tomcat
* docker
* ubuntu
* jdk

I think this would be quite useful and not so hard to implement. A special analyzer could read the configuration holding a list of CPEs and add any found vulnerabilities to the report.

```xml

cpe:2.3:a:nginx:nginx:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*

```

Is there any existing analyzer that can do such tests? Are there any arguments against such an analyzer?