Security advisory tool reports vulnerabilities however no updates are found

Issue

• Security group recently scanned a production Red Hat Enterprise Linux server and reports security vulnerabilities updates do not match the packages releases version, however my security auditing tool says the package version has a security vulnerability.