use upstream oval vulnerability scan