GHSA-hh32-7344-cg2f
The advisories a survey carries survive only in its brief's rendered list of affected locations, and that list stops after a fixed number of entries without the count above it changing — so what a survey was seen to carry is what fitted.
The package it is raised against
Seen against org.springframework.security:spring-security-core and 1 other package name. One advisory id reaching the corpus under more than one package name is stated rather than resolved by picking one.