CAST HIGHLIGHT - API - Difference in High Severity CVE count in the Application page and the API result – CAST

The critical/high CVEs count in an applications Software Composition tabs Security Vulnerabilities display and the count returned by the API were found to be different. API returned more count with criticityLabel set to HIGH.

eg The Application page in the Highlight portal shows 13 CVEs labeled as High Severity while the API shows 15 CVEs with "criticityLabel": "HIGH"

API used is https://<highlight URL>/WS2/domains/<domain id>/applications/<application id>

Reason

The applications Software Composition tab also detect advisories, so it shows the high-severity CVEs and the advisory items separately while the API returns only the total critical/high CVEs count for the applications.

In the portal the advisory items can also be seen. So the UI is correctly showing 13 unique CVEs in the High category with 3 advisory items (2 of which are set to HIGH)

On the other hand the criticityLabel from the API only returns 15 set to HIGH,

CAST HIGHLIGHT - SCA - What are Vulnerabilities (CVE), Weaknesses (CWE), Known Exploited Vulnerabilities (KEV) Advisories and Common Platform Enumeration (CPE) ?