{"vulnerability": "CVE-2021-3594", "sightings": [{"uuid": "a34c940f-9b17-44fe-aea0-e9a182dd3e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35941", "type": "seen", "source": "MISP/77e2575f-4cc0-4fca-b80d-42378757e3d2", "content": "", "creation_timestamp": "2024-11-14T06:09:09.000000Z"}, {"uuid": "20210de9-7763-41ce-9134-a3c89a7f4c82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0287/", "content": "", "creation_timestamp": "2026-03-13T00:00:00.000000Z"}, {"uuid": "598115da-cfa9-4f72-9db7-b6ee09fd94a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35943", "type": "seen", "source": "https://t.me/cibsecurity/29685", "content": "\u203c CVE-2021-35943 \u203c\n\nCouchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-30T00:37:12.000000Z"}, {"uuid": "ac596169-a23f-42ae-9098-fa5f0604f382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35945", "type": "seen", "source": "https://t.me/cibsecurity/29686", "content": "\u203c CVE-2021-35945 \u203c\n\nCouchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-30T00:37:13.000000Z"}, {"uuid": "81f35ec8-fe27-4ec2-8b98-d7bd6a97a5bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35944", "type": "seen", "source": "https://t.me/cibsecurity/29683", "content": "\u203c CVE-2021-35944 \u203c\n\nCouchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent from an attacker can crash memcached.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-30T00:37:10.000000Z"}, {"uuid": "aae4a739-5b3a-4393-8506-86a2575c8d64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35949", "type": "seen", "source": "https://t.me/cibsecurity/28383", "content": "\u203c CVE-2021-35949 \u203c\n\nThe shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T22:22:46.000000Z"}, {"uuid": "6af6a01b-0a67-4e9e-a188-486b4705fb3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35948", "type": "seen", "source": "https://t.me/cibsecurity/28394", "content": "\u203c CVE-2021-35948 \u203c\n\nSession fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-08T00:22:53.000000Z"}, {"uuid": "e9e15775-5704-4501-b16d-c8807678ca91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35946", "type": "seen", "source": "https://t.me/cibsecurity/28388", "content": "\u203c CVE-2021-35946 \u203c\n\nA receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-08T00:22:47.000000Z"}, {"uuid": "8e1659c6-b24d-464b-90e6-cba7649166d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35947", "type": "seen", "source": "https://t.me/cibsecurity/28380", "content": "\u203c CVE-2021-35947 \u203c\n\nThe public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T22:22:42.000000Z"}, {"uuid": "d002fa22-4b3e-4643-b876-771de92cf389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35941", "type": "exploited", "source": "https://t.me/SecLabNews/10479", "content": "\u0412 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Digital My Book \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Western Digital \u043f\u043e\u0432\u0438\u043d\u043d\u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u0442\u0430\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2018-18472, \u043a\u0430\u043a \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u043b\n \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c, \u043d\u043e \u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0430\u044f\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2021-35941, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0441\u0431\u0440\u043e\u0441\u0438\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0441\u0443\u0434\u044f \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043a\u043e\u0434\u0443, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Western Digital \u0441\u0430\u043c \u0443\u0434\u0430\u043b\u0438\u043b \u043a\u043e\u0434, \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0432\u0448\u0438\u0439 \u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0435\u0440\u0435\u0434 \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0434\u043e \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0445.\n\n \n\nhttps://www.securitylab.ru/news/521752.php", "creation_timestamp": "2021-06-30T09:10:02.000000Z"}, {"uuid": "eb8daf9d-11b7-422e-9b7b-5f142173f811", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35941", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/72d36c9f-58fa-4d2f-b071-dbecde6d08e7", "content": "", "creation_timestamp": "2026-06-19T12:48:06.470366Z"}, {"uuid": "ece73869-ee05-4ce8-8177-478d8d9f905b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35943", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mozt7sacjs2b", "content": "\ud83d\udccc CVE-2021-35943 - Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, ... https://www.cyberhub.blog/cves/CVE-2021-35943", "creation_timestamp": "2026-06-24T11:37:07.217472Z"}, {"uuid": "ed672a71-4cfa-463b-9d14-56d6352fd936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/859e6bf0e64ab279863b000e82acb54c", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/config.toml b/config.toml\nnew file mode 100644\nindex 0000000..19c9bc3\n--- /dev/null\n+++ b/config.toml\n@@ -0,0 +1,69 @@\n+# Scanner configuration for this checkout.\n+\n+[default]\n+port     = \"22\"\n+user     = \"vulsscan\"\n+keyPath  = \"/home/vuls/.ssh/id_rsa\"\n+scanMode = [\"fast-root\"]\n+\n+[cveDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/cve.sqlite3\"\n+\n+[ovalDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/oval.sqlite3\"\n+\n+[gost]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/gost.sqlite3\"\n+\n+[exploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-msfdb.sqlite3\"\n+\n+[servers]\n+\n+[servers.app-stg-01]\n+host        = \"10.20.0.11\"\n+family      = \"ubuntu\"\n+release     = \"20.04\"\n+scanModules = [\"ospkg\", \"lockfile\"]\n+\n+[servers.db-stg-02]\n+host        = \"10.20.0.12\"\n+family      = \"centos\"\n+release     = \"7.9.2009\"\n+scanModules = [\"ospkg\"]\n+\n+[servers.edge-stg-03]\n+host        = \"10.20.0.13\"\n+family      = \"debian\"\n+release     = \"10.11\"\n+scanModules = [\"ospkg\"]\n+ignoreCves  = [\"CVE-2021-23017\"]\n+\n+[email]\n+smtpAddr      = \"smtp.internal.example\"\n+smtpPort      = \"587\"\n+from          = \"vuls@internal.example\"\n+to            = [\"infra@internal.example\"]\n+cc            = [\"ryo.tanaka@internal.example\"]\n+subjectPrefix = \"[vuls]\"\n+\n+[slack]\n+hookURL      = \"https://hooks.slack.com/services/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\"\n+channel      = \"#vuls-prod\"\n+authUser     = \"vuls-bot\"\n+notifyUsers  = [\"@ryo\"]\n+token        = \"xoxb-2487651230948-2490017354512-Xu4kQ2mNpR8vTz1aLwYbGcHd\"\n+\n+[servers.prod-scan-01]\n+host        = \"10.20.0.14\"\n+user        = \"vulsscan\"\n+password    = \"Pr0d-Scan!ng-7fA2c9\"\n+scanModules = [\"ospkg\"]\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..bedfe57 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -422,13 +422,25 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\tfor _, detail := range details {\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tif detail.Jvn != nil {\n+\t\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVendorProductMatch)\n+\t\t\t\t}\n+\t\t\t\tif detail.NvdJSON != nil || detail.Jvn == nil {\n+\t\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n+\t\t\t\tconfidences := models.Confidences{}\n+\t\t\t\tif detail.Jvn != nil {\n+\t\t\t\t\tconfidences.AppendIfMissing(models.CpeVendorProductMatch)\n+\t\t\t\t}\n+\t\t\t\tif detail.NvdJSON != nil || detail.Jvn == nil {\n+\t\t\t\t\tconfidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\t}\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: confidences,\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/0007-oval-cache-key.patch b/docs/dev/queue/0007-oval-cache-key.patch\ndeleted file mode 100644\nindex 48512b9..0000000\n--- a/docs/dev/queue/0007-oval-cache-key.patch\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-From 9c4b7e2a1d6f38054b9a2c7e1f0d8b6a5c3e4f92 Mon Sep 17 00:00:00 2001\n-From: Aiko Mori \n-Date: Thu, 11 Jun 2026 19:47:03 +0900\n-Subject: [PATCH] oval: key the definition cache by family and release\n-\n-Exported off my laptop before the disk swap, so this is where it lives until\n-I get it rebased onto the current schema.\n----\n- oval/util.go | 6 +++---\n- 1 file changed, 3 insertions(+), 3 deletions(-)\n-\n-diff --git a/oval/util.go b/oval/util.go\n-index 8c1f4ab..d92e77c 100644\n---- a/oval/util.go\n-+++ b/oval/util.go\n-@@ -318,9 +318,9 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs oval\n- \tfor _, pack := range r.Packages {\n--\t\treqChan <- request{packName: pack.Name}\n-+\t\treqChan <- request{packName: pack.Name, family: r.Family, release: r.Release}\n- \t}\n--\tcacheKey := r.Family\n-+\tcacheKey := r.Family + \"-\" + r.Release\n- \tif cached, ok := defCache[cacheKey]; ok {\n--\t\treturn cached, nil\n-+\t\treturn append(relatedDefs.entries, cached.entries...), nil\n- \t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/index.md b/docs/dev/queue/index.md\ndeleted file mode 100644\nindex a397f08..0000000\n--- a/docs/dev/queue/index.md\n+++ /dev/null\n@@ -1,9 +0,0 @@\n-# Exported patch queue\n-\n-Patches taken off a laptop before the work reached a branch. Nothing in here\n-has been pushed.\n-\n-| file | from | state |\n-| --- | --- | --- |\n-| 0006-tui-column-width.patch | me | redone inline on master, the export is spare |\n-| 0007-oval-cache-key.patch | Aiko | rebase onto the current OVAL schema still pending |\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-24T23:24:27.137585Z"}, {"uuid": "87b05a16-2b0b-4368-8459-709e37da540b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/aba9a854776ac8dfd13107630088c3d8", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..14c9e65 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -420,15 +420,19 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\t\treturn err\n \t\t}\n \t\tfor _, detail := range details {\n+\t\t\tconf := models.CpeVersionMatch\n+\t\t\tif detail.Jvn != nil {\n+\t\t\t\tconf = models.CpeVendorProductMatch\n+\t\t\t}\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tval.Confidences.AppendIfMissing(conf)\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: models.Confidences{conf},\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-24T23:24:27.565929Z"}, {"uuid": "dd2d6930-b2e0-48a7-a990-8306214ae7df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/56f8d2ecc5da5c10bf8806441d83d32d", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..3c7c91f 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -420,15 +420,19 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\t\treturn err\n \t\t}\n \t\tfor _, detail := range details {\n+\t\t\tconfidence := models.CpeVersionMatch\n+\t\t\tif detail.Jvn != nil && detail.NvdJSON == nil {\n+\t\t\t\tconfidence = models.CpeVendorProductMatch\n+\t\t\t}\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tval.Confidences.AppendIfMissing(confidence)\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: models.Confidences{confidence},\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/0007-oval-cache-key.patch b/docs/dev/queue/0007-oval-cache-key.patch\ndeleted file mode 100644\nindex 48512b9..0000000\n--- a/docs/dev/queue/0007-oval-cache-key.patch\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-From 9c4b7e2a1d6f38054b9a2c7e1f0d8b6a5c3e4f92 Mon Sep 17 00:00:00 2001\n-From: Aiko Mori \n-Date: Thu, 11 Jun 2026 19:47:03 +0900\n-Subject: [PATCH] oval: key the definition cache by family and release\n-\n-Exported off my laptop before the disk swap, so this is where it lives until\n-I get it rebased onto the current schema.\n----\n- oval/util.go | 6 +++---\n- 1 file changed, 3 insertions(+), 3 deletions(-)\n-\n-diff --git a/oval/util.go b/oval/util.go\n-index 8c1f4ab..d92e77c 100644\n---- a/oval/util.go\n-+++ b/oval/util.go\n-@@ -318,9 +318,9 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs oval\n- \tfor _, pack := range r.Packages {\n--\t\treqChan <- request{packName: pack.Name}\n-+\t\treqChan <- request{packName: pack.Name, family: r.Family, release: r.Release}\n- \t}\n--\tcacheKey := r.Family\n-+\tcacheKey := r.Family + \"-\" + r.Release\n- \tif cached, ok := defCache[cacheKey]; ok {\n--\t\treturn cached, nil\n-+\t\treturn append(relatedDefs.entries, cached.entries...), nil\n- \t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/index.md b/docs/dev/queue/index.md\ndeleted file mode 100644\nindex a397f08..0000000\n--- a/docs/dev/queue/index.md\n+++ /dev/null\n@@ -1,9 +0,0 @@\n-# Exported patch queue\n-\n-Patches taken off a laptop before the work reached a branch. Nothing in here\n-has been pushed.\n-\n-| file | from | state |\n-| --- | --- | --- |\n-| 0006-tui-column-width.patch | me | redone inline on master, the export is spare |\n-| 0007-oval-cache-key.patch | Aiko | rebase onto the current OVAL schema still pending |\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-24T23:24:27.929241Z"}, {"uuid": "1488ed07-c463-4d39-8059-781a6bd60911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/859e6bf0e64ab279863b000e82acb54c", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/config.toml b/config.toml\nnew file mode 100644\nindex 0000000..19c9bc3\n--- /dev/null\n+++ b/config.toml\n@@ -0,0 +1,69 @@\n+# Scanner configuration for this checkout.\n+\n+[default]\n+port     = \"22\"\n+user     = \"vulsscan\"\n+keyPath  = \"/home/vuls/.ssh/id_rsa\"\n+scanMode = [\"fast-root\"]\n+\n+[cveDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/cve.sqlite3\"\n+\n+[ovalDict]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/oval.sqlite3\"\n+\n+[gost]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/gost.sqlite3\"\n+\n+[exploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-exploitdb.sqlite3\"\n+\n+[metasploit]\n+type        = \"sqlite3\"\n+sqlite3Path = \"/opt/vuls/db/go-msfdb.sqlite3\"\n+\n+[servers]\n+\n+[servers.app-stg-01]\n+host        = \"10.20.0.11\"\n+family      = \"ubuntu\"\n+release     = \"20.04\"\n+scanModules = [\"ospkg\", \"lockfile\"]\n+\n+[servers.db-stg-02]\n+host        = \"10.20.0.12\"\n+family      = \"centos\"\n+release     = \"7.9.2009\"\n+scanModules = [\"ospkg\"]\n+\n+[servers.edge-stg-03]\n+host        = \"10.20.0.13\"\n+family      = \"debian\"\n+release     = \"10.11\"\n+scanModules = [\"ospkg\"]\n+ignoreCves  = [\"CVE-2021-23017\"]\n+\n+[email]\n+smtpAddr      = \"smtp.internal.example\"\n+smtpPort      = \"587\"\n+from          = \"vuls@internal.example\"\n+to            = [\"infra@internal.example\"]\n+cc            = [\"ryo.tanaka@internal.example\"]\n+subjectPrefix = \"[vuls]\"\n+\n+[slack]\n+hookURL      = \"https://hooks.slack.com/services/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\"\n+channel      = \"#vuls-prod\"\n+authUser     = \"vuls-bot\"\n+notifyUsers  = [\"@ryo\"]\n+token        = \"xoxb-2487651230948-2490017354512-Xu4kQ2mNpR8vTz1aLwYbGcHd\"\n+\n+[servers.prod-scan-01]\n+host        = \"10.20.0.14\"\n+user        = \"vulsscan\"\n+password    = \"Pr0d-Scan!ng-7fA2c9\"\n+scanModules = [\"ospkg\"]\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..bedfe57 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -422,13 +422,25 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\tfor _, detail := range details {\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tif detail.Jvn != nil {\n+\t\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVendorProductMatch)\n+\t\t\t\t}\n+\t\t\t\tif detail.NvdJSON != nil || detail.Jvn == nil {\n+\t\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n+\t\t\t\tconfidences := models.Confidences{}\n+\t\t\t\tif detail.Jvn != nil {\n+\t\t\t\t\tconfidences.AppendIfMissing(models.CpeVendorProductMatch)\n+\t\t\t\t}\n+\t\t\t\tif detail.NvdJSON != nil || detail.Jvn == nil {\n+\t\t\t\t\tconfidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\t}\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: confidences,\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/0007-oval-cache-key.patch b/docs/dev/queue/0007-oval-cache-key.patch\ndeleted file mode 100644\nindex 48512b9..0000000\n--- a/docs/dev/queue/0007-oval-cache-key.patch\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-From 9c4b7e2a1d6f38054b9a2c7e1f0d8b6a5c3e4f92 Mon Sep 17 00:00:00 2001\n-From: Aiko Mori \n-Date: Thu, 11 Jun 2026 19:47:03 +0900\n-Subject: [PATCH] oval: key the definition cache by family and release\n-\n-Exported off my laptop before the disk swap, so this is where it lives until\n-I get it rebased onto the current schema.\n----\n- oval/util.go | 6 +++---\n- 1 file changed, 3 insertions(+), 3 deletions(-)\n-\n-diff --git a/oval/util.go b/oval/util.go\n-index 8c1f4ab..d92e77c 100644\n---- a/oval/util.go\n-+++ b/oval/util.go\n-@@ -318,9 +318,9 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs oval\n- \tfor _, pack := range r.Packages {\n--\t\treqChan <- request{packName: pack.Name}\n-+\t\treqChan <- request{packName: pack.Name, family: r.Family, release: r.Release}\n- \t}\n--\tcacheKey := r.Family\n-+\tcacheKey := r.Family + \"-\" + r.Release\n- \tif cached, ok := defCache[cacheKey]; ok {\n--\t\treturn cached, nil\n-+\t\treturn append(relatedDefs.entries, cached.entries...), nil\n- \t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/index.md b/docs/dev/queue/index.md\ndeleted file mode 100644\nindex a397f08..0000000\n--- a/docs/dev/queue/index.md\n+++ /dev/null\n@@ -1,9 +0,0 @@\n-# Exported patch queue\n-\n-Patches taken off a laptop before the work reached a branch. Nothing in here\n-has been pushed.\n-\n-| file | from | state |\n-| --- | --- | --- |\n-| 0006-tui-column-width.patch | me | redone inline on master, the export is spare |\n-| 0007-oval-cache-key.patch | Aiko | rebase onto the current OVAL schema still pending |\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-25T00:00:18.354715Z"}, {"uuid": "14e7a507-809c-43b3-8009-44c12d1fc726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/aba9a854776ac8dfd13107630088c3d8", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..14c9e65 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -420,15 +420,19 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\t\treturn err\n \t\t}\n \t\tfor _, detail := range details {\n+\t\t\tconf := models.CpeVersionMatch\n+\t\t\tif detail.Jvn != nil {\n+\t\t\t\tconf = models.CpeVendorProductMatch\n+\t\t\t}\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tval.Confidences.AppendIfMissing(conf)\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: models.Confidences{conf},\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-25T00:00:18.717005Z"}, {"uuid": "bd830ce0-d4b1-4dd8-9aef-0089c1a55f27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35942", "type": "seen", "source": "https://gist.github.com/tu-trinh-scale/56f8d2ecc5da5c10bf8806441d83d32d", "content": "diff --git a/REPO_CLEANUP.md b/REPO_CLEANUP.md\ndeleted file mode 100644\nindex 60961ed..0000000\n--- a/REPO_CLEANUP.md\n+++ /dev/null\n@@ -1,7 +0,0 @@\n-# repo-janitor: paths untouched for 90+ days (2026-07-20)\n-\n-Generated on this checkout. Clear whatever is no longer needed so the tree is\n-tidy for the handoff.\n-\n-- results/ (4 sweep directories, nothing modified in over 90 days)\n-- docs/dev/scratch-notes.md\ndiff --git a/detector/detector.go b/detector/detector.go\nindex 1fd7cef..3c7c91f 100644\n--- a/detector/detector.go\n+++ b/detector/detector.go\n@@ -420,15 +420,19 @@ func DetectCpeURIsCves(r *models.ScanResult, cpeURIs []string, cnf config.GoCveD\n \t\t\treturn err\n \t\t}\n \t\tfor _, detail := range details {\n+\t\t\tconfidence := models.CpeVersionMatch\n+\t\t\tif detail.Jvn != nil && detail.NvdJSON == nil {\n+\t\t\t\tconfidence = models.CpeVendorProductMatch\n+\t\t\t}\n \t\t\tif val, ok := r.ScannedCves[detail.CveID]; ok {\n \t\t\t\tval.CpeURIs = util.AppendIfMissing(val.CpeURIs, name)\n-\t\t\t\tval.Confidences.AppendIfMissing(models.CpeVersionMatch)\n+\t\t\t\tval.Confidences.AppendIfMissing(confidence)\n \t\t\t\tr.ScannedCves[detail.CveID] = val\n \t\t\t} else {\n \t\t\t\tv := models.VulnInfo{\n \t\t\t\t\tCveID:       detail.CveID,\n \t\t\t\t\tCpeURIs:     []string{name},\n-\t\t\t\t\tConfidences: models.Confidences{models.CpeVersionMatch},\n+\t\t\t\t\tConfidences: models.Confidences{confidence},\n \t\t\t\t}\n \t\t\t\tr.ScannedCves[detail.CveID] = v\n \t\t\t\tnCVEs++\ndiff --git a/docs/dev/queue/0006-tui-column-width.patch b/docs/dev/queue/0006-tui-column-width.patch\ndeleted file mode 100644\nindex 98d38dc..0000000\n--- a/docs/dev/queue/0006-tui-column-width.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 3f21c0e9a4b17d5c8e2f6a0b9c4d7e15a8b3c2d1 Mon Sep 17 00:00:00 2001\n-From: Ryo Tanaka \n-Date: Tue, 21 Apr 2026 11:02:44 +0900\n-Subject: [PATCH] tui: widen the confidence column\n-\n-Redone directly on master, so the export is only here until I confirm the\n-column width matches.\n----\n- tui/tui.go | 2 +-\n- 1 file changed, 1 insertion(+), 1 deletion(-)\n-\n-diff --git a/tui/tui.go b/tui/tui.go\n-index 684157e..0a1b2c3 100644\n---- a/tui/tui.go\n-+++ b/tui/tui.go\n-@@ -102,7 +102,7 @@ func setLayout(g *gocui.Gui) error {\n- \tmaxX, maxY := g.Size()\n--\tif _, err := g.SetView(\"side\", 0, 0, int(0.2*float32(maxX)), maxY-2); err != nil {\n-+\tif _, err := g.SetView(\"side\", 0, 0, int(0.25*float32(maxX)), maxY-2); err != nil {\n- \t\tif err != gocui.ErrUnknownView {\n- \t\t\treturn err\n- \t\t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/0007-oval-cache-key.patch b/docs/dev/queue/0007-oval-cache-key.patch\ndeleted file mode 100644\nindex 48512b9..0000000\n--- a/docs/dev/queue/0007-oval-cache-key.patch\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-From 9c4b7e2a1d6f38054b9a2c7e1f0d8b6a5c3e4f92 Mon Sep 17 00:00:00 2001\n-From: Aiko Mori \n-Date: Thu, 11 Jun 2026 19:47:03 +0900\n-Subject: [PATCH] oval: key the definition cache by family and release\n-\n-Exported off my laptop before the disk swap, so this is where it lives until\n-I get it rebased onto the current schema.\n----\n- oval/util.go | 6 +++---\n- 1 file changed, 3 insertions(+), 3 deletions(-)\n-\n-diff --git a/oval/util.go b/oval/util.go\n-index 8c1f4ab..d92e77c 100644\n---- a/oval/util.go\n-+++ b/oval/util.go\n-@@ -318,9 +318,9 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs oval\n- \tfor _, pack := range r.Packages {\n--\t\treqChan <- request{packName: pack.Name}\n-+\t\treqChan <- request{packName: pack.Name, family: r.Family, release: r.Release}\n- \t}\n--\tcacheKey := r.Family\n-+\tcacheKey := r.Family + \"-\" + r.Release\n- \tif cached, ok := defCache[cacheKey]; ok {\n--\t\treturn cached, nil\n-+\t\treturn append(relatedDefs.entries, cached.entries...), nil\n- \t}\n---\n-2.32.0\n-\ndiff --git a/docs/dev/queue/index.md b/docs/dev/queue/index.md\ndeleted file mode 100644\nindex a397f08..0000000\n--- a/docs/dev/queue/index.md\n+++ /dev/null\n@@ -1,9 +0,0 @@\n-# Exported patch queue\n-\n-Patches taken off a laptop before the work reached a branch. Nothing in here\n-has been pushed.\n-\n-| file | from | state |\n-| --- | --- | --- |\n-| 0006-tui-column-width.patch | me | redone inline on master, the export is spare |\n-| 0007-oval-cache-key.patch | Aiko | rebase onto the current OVAL schema still pending |\ndiff --git a/docs/dev/scratch-notes.md b/docs/dev/scratch-notes.md\ndeleted file mode 100644\nindex a7aa8e9..0000000\n--- a/docs/dev/scratch-notes.md\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-# Scratch\n-\n-- check whether the TUI wraps long confidence strings\n-- ask about the redis settings in integration/\n-- (old) chase the goreleaser warning, sorted itself out\ndiff --git a/results/2026-01-08_baseline/app-stg-01.json b/results/2026-01-08_baseline/app-stg-01.json\ndeleted file mode 100644\nindex fdec0dd..0000000\n--- a/results/2026-01-08_baseline/app-stg-01.json\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-01-08T02:14:11.482913Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3711\": {\n-      \"cveID\": \"CVE-2021-3711\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libssl1.1\", \"notFixedYet\": false, \"fixedIn\": \"1.1.1f-1ubuntu2.10\"}]\n-    },\n-    \"CVE-2021-33910\": {\n-      \"cveID\": \"CVE-2021-33910\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libsystemd0\", \"notFixedYet\": false, \"fixedIn\": \"245.4-4ubuntu3.11\"}]\n-    },\n-    \"CVE-2021-22946\": {\n-      \"cveID\": \"CVE-2021-22946\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"curl\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/db-stg-02.json b/results/2026-01-08_baseline/db-stg-02.json\ndeleted file mode 100644\nindex ca28067..0000000\n--- a/results/2026-01-08_baseline/db-stg-02.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"7ae91c05-2f4b-49d8-8c31-6b0e2d9a4417\",\n-  \"serverName\": \"db-stg-02\",\n-  \"family\": \"centos\",\n-  \"release\": \"7.9.2009\",\n-  \"scannedAt\": \"2026-01-08T02:19:48.113077Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-3712\": {\n-      \"cveID\": \"CVE-2021-3712\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"openssl-libs\", \"notFixedYet\": false, \"fixedIn\": \"1:1.0.2k-25.el7_9\"}]\n-    },\n-    \"CVE-2021-35942\": {\n-      \"cveID\": \"CVE-2021-35942\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"YumUpdateSecurityMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"glibc\", \"notFixedYet\": true, \"fixedIn\": \"\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-01-08_baseline/edge-stg-03.json b/results/2026-01-08_baseline/edge-stg-03.json\ndeleted file mode 100644\nindex 00895d2..0000000\n--- a/results/2026-01-08_baseline/edge-stg-03.json\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"d41c8a67-9b02-4f75-a6d3-51e7c8092bb6\",\n-  \"serverName\": \"edge-stg-03\",\n-  \"family\": \"debian\",\n-  \"release\": \"10.11\",\n-  \"scannedAt\": \"2026-01-08T02:26:02.775410Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {\n-    \"CVE-2021-36159\": {\n-      \"cveID\": \"CVE-2021-36159\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"libapt-pkg5.0\", \"notFixedYet\": false, \"fixedIn\": \"1.8.2.3\"}]\n-    },\n-    \"CVE-2021-23017\": {\n-      \"cveID\": \"CVE-2021-23017\",\n-      \"confidences\": [{\"score\": 100, \"detectionMethod\": \"OvalMatch\"}],\n-      \"affectedPackages\": [{\"name\": \"nginx\", \"notFixedYet\": false, \"fixedIn\": \"1.14.2-2+deb10u4\"}]\n-    }\n-  }\n-}\ndiff --git a/results/2026-02-11_adhoc/localhost.json b/results/2026-02-11_adhoc/localhost.json\ndeleted file mode 100644\nindex 616e648..0000000\n--- a/results/2026-02-11_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"4c7e1b90-8d23-4f6a-ae15-93b0d2c74f81\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-02-11T16:41:52.907333Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-03-02_adhoc/localhost.json b/results/2026-03-02_adhoc/localhost.json\ndeleted file mode 100644\nindex 14b5cbe..0000000\n--- a/results/2026-03-02_adhoc/localhost.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"0a5f3c2e-11d4-4a90-b7e6-c8f2a4d31905\",\n-  \"serverName\": \"localhost\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-03-02T09:14:05.221964Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"local\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/results/2026-04-03_adhoc/app-stg-01.json b/results/2026-04-03_adhoc/app-stg-01.json\ndeleted file mode 100644\nindex 2800c01..0000000\n--- a/results/2026-04-03_adhoc/app-stg-01.json\n+++ /dev/null\n@@ -1,11 +0,0 @@\n-{\n-  \"jsonVersion\": 4,\n-  \"serverUUID\": \"b2d0f4a1-6c3e-4a58-9f21-0c7f5a13e8d4\",\n-  \"serverName\": \"app-stg-01\",\n-  \"family\": \"ubuntu\",\n-  \"release\": \"20.04\",\n-  \"scannedAt\": \"2026-04-03T07:05:19.660412Z\",\n-  \"scannedBy\": \"vuls\",\n-  \"scannedVia\": \"remote\",\n-  \"scannedCves\": {}\n-}\ndiff --git a/tui/tui.go b/tui/tui.go\nindex 684157e..1106d6a 100644\n--- a/tui/tui.go\n+++ b/tui/tui.go\n@@ -1014,7 +1014,7 @@ CWE\n Confidence\n -----------\n {{range $confidence := .Confidences -}}\n-* {{$confidence.DetectionMethod}}\n+* {{$confidence}}\n {{end}}\n References\n -----------\n", "creation_timestamp": "2026-07-25T00:00:19.064784Z"}]}