grep outputs a string, right? But when I get to the next line, I get the scalar/count output...

my @matched_cve = split(',', @matched);
[download]

grep returns a list not a scalar. Also, split evaluates the expression in scalar context that is why you are getting the count of the elements in @matched