CVE dependency scanning