Previously, Vulnerabilities API would return all however it should only
return non-dismissed by default. This behavior can be changed with
`scope=all`