I/O is buffered by default. The output is written to the file when the (4KB) buffer fills up, not just when the file handle is closed.

Buffering can be turned off on a per handle basis.

use IO::Handle qw( );
VULNFILE->autoflush(1);
[download]

By the way, do you have a reason to use global variables and 2-arg open?

use strict;
use warnings;

use IO::Handle qw( );

my $list_qfn = '...';
my $vuln_qfn = '...';

open(my $list_fh, '<', $list_qfn)
   or die("Unable to open list file \"$list_qfn\": $!\n);
open(my $vuln_fh, '>>', $vuln_qfn)
   or die("Unable to append to vulnerability file \"$vuln_qfn\": $!\n)
+;

# Disable buffering.
$vuln_fh->autoflush(1);

while (<$list_fh>) {
   chomp;
   if (/OK/) {
      print $vuln_fh "OK\n";
   }
}

close($list_fh);
close($vuln_fh);
[download]