Fixing reporting of multiple vulns in a library