Bug: Severity bar chart renders bar under wrong X-axis category (bar position mismatch, tooltip appears correct)

[mariotcss]

DefectDojo version

3.2.0 (open-source)

Description

Severity distribution bar charts (both in the HTML Engagement/Product report and in the "Metrics Overview" asset page) render the single non-zero bar under the "Critical" category on the X-axis, regardless of the actual severity of the underlying findings. The tooltip/legend for the bar shows what appears to be the correct severity label and count, but the bar itself is drawn at the wrong horizontal position (always the first category slot).

Steps to Reproduce

1. Generate an HTML report for an Engagement/Product/Asset where all findings share a single severity that is not "Critical" (in our case, all findings are "Low").
   URL pattern used:
   https://<host>/organization/12/report?include_finding_notes=0&include_finding_images=0&include_executive_summary=1&include_table_of_contents=1&include_disclaimer=1&report_type=HTML&severity=Low&severity=Medium&severity=High&severity=Critical&active=1&false_p=2&duplicate=2&out_of_scope=2&_generate=
2. Observe the "Engagement Finding Count" chart. A total of 16 findings are reported (confirmed in the "Findings" section below the chart, all 16 are Severity: Low, e.g. Finding 7876: TCP Timestamps Information Disclosure).
3. In the chart, the bar (height 16) is drawn under the "Critical" X-axis label. Hovering shows tooltip header "Critical" / legend text "Low: 16".
4. Separately, visit the asset-level Metrics Overview page:
   https://<host>/asset/37/metrics
5. In the "Open Findings" widget (count: 62), the bar is again drawn under "Critical". Hovering shows tooltip header "Critical" / legend text "Info: 62".

Expected behavior

The bar should be drawn under the X-axis category matching its actual severity (e.g., under "Low" for the 16 Low-severity findings in the report; under whatever the true severity is for the 62 findings in the asset metrics widget, not independently confirmed for this second case, but the pattern matches the first).

Actual behavior

The bar is always rendered under the first category ("Critical") on the X-axis, while the tooltip/legend label appears to retain the correct severity name and count.

Evidence

• Screenshot 1 (report_findings.png): Engagement HTML report — bar under "Critical", tooltip "Low: 16", findings table below confirms all 16 findings are Severity: Low.
• Screenshot 2 (metrics.png): Asset Metrics Overview (/asset/37/metrics) — bar under "Critical", tooltip "Info: 62" (severity of the 62 underlying findings not independently verified in this screenshot).

Environment

• DefectDojo: 3.2.0 (open-source)
• Report type: HTML (Engagement/Organization report), Asset Metrics Overview page

Thanks

metrics.png

report_findings.png