Why aren't all CVEs reported?

It seems only some CVEs are reported but not others, I’m not sure if there’s a severity threshold under which vulnerabilities are ignored.

• it should be made clear, in the project’s readme at least, what the scope of this analysis is, i.e. what’s vulnerability criteria are used to flag a vulnerable dependency,
• if there’s indeed a threshold, then, it should be made user configurable, and different vulns could be reported with different diagnostic severities (warning, info for lower severities)

Examples of ignored vulns in pom.xml:

<dependency>
  <groupId>org.apache.poi</groupId>
  <artifactId>poi</artifactId>
  <version>3.16</version> <!-- https://www.cvedetails.com/cve/CVE-2017-12626/ -->
</dependency>
<dependency>
  <groupId>org.springframework.amqp</groupId>
  <artifactId>spring-amqp</artifactId>
  <version>1.4.4.RELEASE</version><!-- https://www.cvedetails.com/cve/CVE-2016-2173/ -->
</dependency>
<dependency>
  <groupId>org.springframework</groupId>
  <artifactId>spring-webmvc</artifactId>
  <version>3.2.3.RELEASE</version> <!-- https://www.cvedetails.com/cve/CVE-2013-7315/ -->
</dependency>

All those dependencies are flagged as critically vulnerable in https://search.maven.org/

[jeffmaury]

Tested with both the Struts2 and the Jetty dependencies and they are now correctly reported as vulnerable:

[pdaverh]

We released a new version of the extension that now leverages Snyk Intel - a comprehensive commercial vulnerability database - for its analysis. Can you please update the extension and try it out?