Those products are covered by security fixes not raising the version of the product itself (Called “backports” in the Linux world).
Because of this most “Linux” VTs which are checking for a Banner of a software (especially valid for nginx and OpenSSH) have a QoD of remote_banner_unreliable (See Overview on QoD values and types ).
This means vulnerabilities of such VTs are not showing up by default in your reports. To show them you need to update your filter to show results for VTs having a QoD < 70 %.