Visual Studio NuGet says I have 3 vulnerable packages, then shows me 0

So NuGet says I have 3 vulnerable packages. But when I then ask for a listing of the vulnerable packages, I get 0. What is going on here?

Update: And it gets weirder. I updated Visual Studio and now:

1. Looking at NuGet for the solution it says I have 1 vulnerable package, but shows 0.
2. Looking at NuGet for my main web project it says I have 5 vulnerable packages - and shows all 5.

So clearly there's some bugs around this in the latest Visual Studio pre-release.