No CVEs recorded for “pip”.

Vendor keys are normalized slugs — red_hat becomes redhat. The catalog may also still be syncing.