Vulnerabilities in CF application files

WT, first let's acknowledge that a problem with such sec scan tools is that they rarely have any understanding of the applications being scanned: they simply look at ALL files within a given folder or file system to see if any are what they regard to be "vulnerable"--even if happens to be that the file is not being (or perhaps can't even be used) by that app. But I appreciate that some who mandate use of the scanning tool don't care about that. 

So to your point 1, the files in the bundles/repo relate specifically to CF PACKAGES, the new modular bundling of cf functionality introduced in cf2021. And more important, the files there are either for packages that are or are NOT installed (within cf), and also for different VERSIONS of any given package. And these libraries are often not files Adobe created but rather jars that cf bundles for use with such packages.

As such, there may well be files your scans finds which Adobe UPDATED (perhaps even for the sake of security), but they don't DELETE them simply because they were vulnerable. The intent is that in updating the package, the old files are no longer "used" by cf.

So sadly, no, there's no mechanism to have cf REMOVE the files in the repo that may no longer be in use; nor is there a mechanism to help you decide what could be removed. An extreme response would be to try to identify what jars are used by what packages that ARE installed (via the cf admin, cfpm, or studying config files), and remove all else. I don't know of anyone having done that, and there may be more dependencies than can be determined completely even by those means above.

Consider filing a feature request that asks Adobe to improve this. 

To your point 2, the same applies. But as you note, if you don't ever plan to uninstall your current update, you could delete those hotfix jars.

Even so, note as well that when an update is applied, the update creates a backup of many files used to DO that uninstall of an update. Someone with your concern and intending NEVER to uninstall the current could technically delete the files on that backup folder...but again there's not a "feature" that does it.

3) Finally, no, there's no connection at all between the solr.war and the pdf generation. Now., technically, that war comes with CF if one told the cf installer (or war builder) to include solr. And both the solr.war and pdfg web app are siblings that one can install as web apps in cf (or your preferred jre app server). But they're not otherwise connected TO each other.

So it would seem that there HAS to be some other explanation for what you're observing. 

How did you create your cf war? There are multiple ways one can.