Since groups can contain multiple projects, we need to check that all
related vulnerabilities all included in the response.