I'm struggling to get my head round something DC is doing on a couple of systems here in regards to mismatch of information on a system or two.

Here is the missing patches listed as critical on one of our servers. And also a screenshot of the internet explorer about window indicating that this patch is installed. 

I've looked in windows update and it doesn't list the patch as installed so I'm assuming maybe it's included as part of a system roll up or something of the like? 

My question is why? - When I'm trying to use DC as my main focus of checking systems patch levels how can I be safe that it's representing it correctly if there is this type of inconsistency? I would have thought it would be able to understand if its installed as part of another update?Or am I missing something obvious?

I've checked we have an updated patchdb and rescanned a machine a few times over and still has the same issues -  I've included a couple of screenshots below so you can see where its missing and the fact that its actually installed.

Thanks