diff --git a/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
index 0af4f2524..6c6374a57 100644
--- a/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
+++ b/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
@@ -401,7 +401,7 @@ public class Dependency {
      *
      * @return the list of vulnerabilities
      */
-    public Set<Vulnerability> getVulnerabilities() {
+    public SortedSet<Vulnerability> getVulnerabilities() {
         return vulnerabilities;
     }
 
diff --git a/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java b/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
index 859308bde..058df3f38 100644
--- a/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
+++ b/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
@@ -21,6 +21,8 @@ package org.owasp.dependencycheck.dependency;
 import java.io.Serializable;
 import java.util.HashSet;
 import java.util.Set;
+import java.util.SortedSet;
+import java.util.TreeSet;
 
 /**
  * Contains the information about a vulnerability.
@@ -126,14 +128,14 @@ public class Vulnerability implements Serializable, Comparable<Vulnerability> {
     /**
      * A set of vulnerable software.
      */
-    private Set<VulnerableSoftware> vulnerableSoftware = new HashSet<VulnerableSoftware>();
+    private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
 
     /**
      * Get the value of vulnerableSoftware.
      *
      * @return the value of vulnerableSoftware
      */
-    public Set<VulnerableSoftware> getVulnerableSoftware() {
+    public SortedSet<VulnerableSoftware> getVulnerableSoftware() {
         return vulnerableSoftware;
     }
 
@@ -142,7 +144,7 @@ public class Vulnerability implements Serializable, Comparable<Vulnerability> {
      *
      * @param vulnerableSoftware new value of vulnerableSoftware
      */
-    public void setVulnerableSoftware(Set<VulnerableSoftware> vulnerableSoftware) {
+    public void setVulnerableSoftware(SortedSet<VulnerableSoftware> vulnerableSoftware) {
         this.vulnerableSoftware = vulnerableSoftware;
     }