The vulnerabilities database NVD only finds xstream component with VENDOR= xstream_project

[joseluiswork]

The vulnerabilities database NVD only finds xstream component with VENDOR= xstream_project
Shouldn't Github xstream collaborators fix that contacting NVD?

The CPE for xstream at NVD is currently: cpe:/:xstream_project:xstream:1.1.2

If the cpe in an SBOM file is set to cpe:/:xstream:xstream:1.1.2 then it does not show the vulnerability results in NVD database.

https://nvd.nist.gov/vuln/search/results?results_type=overview&search_type=all&form_type=Advanced&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Axstream_project&cpe_product=cpe%3A%2F%3Axstream_project%3Axstream&cpe_version=cpe%3A%2F%3Axstream_project%3Axstream%3A1.1.2&orderBy=publishDate&orderDir=desc

[joehni]

Sorry, but I have no idea who and how these entries were generated.