web interface: display only a handful of CVEs in /vulnerable report to make it more usable