Interpreting vulnerability scanners is a hard task. They are often screaming for "common cases", but remember XCP-ng is an appliance, so there are many cases where things do not apply. Happy to help you further via our pro support to answer in details your concerns 🙂