Dependency vulnerability scan does not report CVE-2026-40973, but reports newer CVE-2026-4258

Hello support team,

We are using Dependency Check to scan vulnerable dependencies in our Java components.

We noticed an inconsistency in scan results:

• CVE-2026-40973 is not reported in the scan output
• CVE-2026-42581 is reported
• CVE-2026-40982 is reported
• CVE-2026-41002 is reported

We also checked suppressed vulnerabilities but could not find CVE-2026-40973 anywhere However, this CVE-2026-40973 is reported when using Sonatype scan

Could you help to guide how to investigate to find out the root cause why CVE-2026-40973 is not reported with Dependency Check tool?