Asset discovery scan shows vulnerabilities

Good day all,

I am running a network discovery scan using Nexpose in our environment using the template provided by rapid7 and to my surprise I see that the malware kits and vulnerabilities columns are being populated.

I have double checked the template and the vulnerabilities scan checks is disabled.

Does anyone know how is this possible? Could it be using the fingerprinting for this?