Every scanner you run is looking backwards. A CVE is a record of something already found. By the time one exists, a researcher has spotted the flaw, someone has assigned it an identifier, and a database has published it.
Source: [Dev.to](https://dev.to/fortitudeomnis/the-fastest-trigger-produces-no-cve-5hj9)