No CVEs recorded for “unknown”.

Vendor keys are normalized slugs — red_hat becomes redhat. The catalog may also still be syncing.