Fix mixed pessimistic and optimistic vulnerability checking