Ids such as `CVE-2011-4461-JETTY` are appearing as vulnerability id which are clearly not valid CVEs. It can be mitigated by either - Using `is_cve` helper and the `.group(0)` to get the matching cve - Adding `$` in is_cve helper making it `r"CVE-\d+-\d+$"` in order to avoid any invalid matches.