Clarification on CVE Reporting Changes in OWASP Dependency-Check

Hi Team,

With reference to this ticket: https://github.com/dependency-check/DependencyCheck/issues/8276, we are scanning our project using the following OWASP Dependency-Check Maven command:

```bash
mvn org.owasp:dependency-check-maven:13.0.0:aggregate \
-Danalyzer.bundle.audit.enabled=false \
-Danalyzer.central.enabled=true
```

When we ran this scan in June 2026 for our application with the same parameters, the following CVEs were **not** reported:

- CVE-2019-20445
- CVE-2019-16869
- CVE-2019-10211
- CVE-2019-10127
- CVE-2019-10128
- CVE-2019-10210

However, running the same command now on the same application reports all of the above CVEs.

Could you help us understand the reason for this discrepancy in the scan results between the June 2026 run and the current run?

Additionally, in the latest scan the **identifier** field is not populated for these CVEs in the OWASP output, which makes it difficult to construct a proper package URL when raising tickets (for example, similar to the approach described in Issue #8276). Any guidance on why the identifiers are missing and how we should proceed would be appreciated.

Thank you in advance for your support.