I don't think Vanta itself even scans for CVEs? They scan for compliance which includes tooling that may look for CVEs, like Dependabot.

Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.