you are missing the `<vulnerability>` start tag