Cortex Cloud: Cortex CLI image scan - Vulnerability count for image different from UI scan results

When cortexcli image scan is run, the vulnerability count shown on the cli output is different from the scan results on the UI. 

Example :

In the CLI, the output shows 0 counts under MEDIUM and LOW count.

$ sudo ./cortexcli --log-level DEBUG --api-base-url https://api-tac-x5.xdr.sg.paloaltonetworks.com --api-key mTnIMoq... --api-key-id 27 image scan rockon/nginx_webserver:1.26.3-otel

Scans result for image sha256:5a3b2aaea787f65b674d36dad02a5ccbfe238ddce4dbb60c82603dfaa539b4d0 - sha256:5a3b2aaea787f65b674d36dad02a5ccbfe238ddce4dbb60c82603dfaa539b4d0
+---------------+-------+----------+------+--------+-----+
|     TYPE      | TOTAL | CRITICAL | HIGH | MEDIUM | LOW |
+---------------+-------+----------+------+--------+-----+
| Malware       |   0   |    0     |  0   |   0    |  0  |
+---------------+-------+----------+------+--------+-----+
| Secrets       |   0   |    0     |  0   |   0    |  0  |
+---------------+-------+----------+------+--------+-----+
| Vulnerability |  21   |    4     |  17  |   0    |  0  |
+---------------+-------+----------+------+--------+-----+
Scan status - PASSED
Scan completed successfully, but at least 1 issue found

However, in the UI, the same image scan results shows multiple LOW and MEDIUM CVEs to be present. 

Inventory > Assets > All Assets > Compute > Container Images

• Cortex Cloud
• CI scans
• Cortex CLI

The Vulnerability results in the CLI when cortexcli is used to scan an image is controlled by the Prevention Rule.
Posture Management > Rules & Policies > Policies > Vulnerability Management > Prevention

Since the default rule used for reporting only had Critical and High CVSS Severity selected as part of the Match Criteria, and there were no other rules that matched the other severities, only Critical and High Severity counts were shown in the CLI results. 

Edit the existing rule, or configure a new rule to match all of the CVSS severities.