Security Report shows 4 Security Issues while Issues tab shows only 2 Vulnerabilities

SonarQube Server / Community Build
1

Hi Team,

I’m using SonarQube Enterprise Edition v2026.1 (119033) and noticed a discrepancy between the Issues view and the Security Report.

In the Issues tab:

  • Vulnerabilities: 2
  • Security Hotspots: 0

Both vulnerabilities are the same rule:

In the Security Report (Sonar category), the project shows:

  • 4 Security issues to address
  • 0 Security Hotspots that need review

After reviewing the findings, I noticed that each vulnerability is mapped to two CWE identifiers.

My expectation is that the Security Report should show 2 security issues, since there are only 2 unique vulnerability findings. A vulnerability being associated with multiple CWEs is a classification detail and does not appear to represent additional vulnerability instances.

Is the “Security issues to address” metric intended to count:

  1. Unique vulnerability findings, or
  2. Vulnerability-to-CWE mappings/occurrences?

If this behavior is expected,could you explain how the Security Report calculates the count?

Thanks you

3

Hi Ghaith! This is indeed expected behavior. In general, security reports may find multiple security issues attached to a single vulnerability.

The total count of security issues in a security report should be the sum of the number of security issues across all its categories. If an issue shows up in more than one category, it will be double-counted in the overall count.

You can think of this as the security report tallying up the “symptoms”, whereas the raw vulnerability count tallies up the number of underlying “diseases” to address. This is necessary because a single vulnerability could cause both a minor security weakness in one CWE, while also causing a major vulnerability via a different CWE, and those need to be communicated separately, even if they will necessarily be fixed in one go.