fix bug where vulnerability was not being set