A lot of them seem pretty low-quality automated reports... It would not surprise me if it turns out some of the issues had been deleted. > First parameter (wi

A lot of them seem pretty low-quality automated reports... It would not surprise me if it turns out some of the issues had been deleted. > First parameter (with value "MD5") should be any of {SHA-256, SHA-384, SHA-512} Well, surely that depends? If it's being used as a cache key or otherwise not in a security-critical application, who cares? > First parameter (with value "EC") should be any of {RSA, DSA, Diffie-Hellman} You mean the tool doesn't understand what elliptic curve crypto is?