code: private Vulnerability createVulnerability(String parentName, Dependency dependency, String gem, String nextLine) throws CpeValidationException {
          Vulnerability vulnerability = null;
          if (null != dependency) {
              final String version = nextLine.substring(VERSION.length());
              dependency.addEvidence(EvidenceType.VERSION,
                      "bundler-audit",
                      "Version",
                      version,
                      Confidence.HIGHEST);
              dependency.setVersion(version);
              dependency.setName(gem);
              try {
                  final PackageURL purl = PackageURLBuilder.aPackageURL().withType("gem").withName(dependency.getName())
                          .withVersion(dependency.getVersion()).build();
                  dependency.addSoftwareIdentifier(new PurlIdentifier(purl, Confidence.HIGHEST));
              } catch (MalformedPackageURLException ex) {
                  LOGGER.debug("Unable to build package url for python", ex);
                  final GenericIdentifier id = new GenericIdentifier("gem:" + dependency.getName() + "@" + dependency.getVersion(),
                          Confidence.HIGHEST);
                  dependency.addSoftwareIdentifier(id);
              }
  
              vulnerability = new Vulnerability(); // don't add to dependency until we have name set later
              final VulnerableSoftwareBuilder builder = new VulnerableSoftwareBuilder();
              final VulnerableSoftware vs = builder.part(Part.APPLICATION)
                      .vendor(gem)
                      .product(String.format("%s_project", gem))
                      .version(version).build();
              vulnerability.addVulnerableSoftware(vs);
              vulnerability.setMatchedVulnerableSoftware(vs);
              vulnerability.setCvssV2(new CvssV2(-1, "-", "-", "-", "-", "-", "-", "unknown"));
          }
          LOGGER.debug("bundle-audit ({}): {}", parentName, nextLine);
          return vulnerability;
      }
docs: Creates a vulnerability.
  
  @param parentName the parent name
  @param dependency the dependency
  @param gem the gem name
  @param nextLine the line to parse
  @return the vulnerability
  @throws CpeValidationException thrown if there is an error building the
  CPE vulnerability object