...
Improvements have been made to improve the detection of signatures for the DBCP and SSH libraries' sendcredential methods. Therefore, after an upgrade to CAST AIP 8.3.16 and the generation of a post-upgrade consistency snapshot on unchanged source code, results may change. You may have violations where previously there were none.
AIPCORE-777 - Total number of violations is higher than the total number of checks for certain rules
A bug has been discovered that is causing the values for Total Checks and Number of Violations to be erroneous (the total number of violations is higher than the total number of checks performed
AIPCORE-571 - False violations on JEE source code
...