Challenges of mapping Vulnerabilities and Exposures to Open-Source Packages