This is, btw, the current main problem with the CVE system - something having a CVE doesn't actually mean there's acute risk in it. It requires a lot of technic

This is, btw, the current main problem with the CVE system - something having a CVE doesn't actually mean there's acute risk in it. It requires a lot of technical prowess to actually confirm whether a specific CVE actually is exploitable or not. Then you have to figure out how vulnerable your context of use actually is. Then whether somebody is actually actively using this vulnerability. It's a much longer chain of risk decisions than you would first be lead to believe.