Yes, CVEs are often exaggerated and sometimes just plain wrong. The bulk of them tend to be created by people that gain somehow, either financially or reputatio

Yes, CVEs are often exaggerated and sometimes just plain wrong. The bulk of them tend to be created by people that gain somehow, either financially or reputationally by creating them, and have no affiliation with either the person who originally discovered the bug or the upstream project that fixed the bug. Such people have every incentive to maximize impact and no incentive to do due diligence. And the review process for CVEs is entirely inadequate to the volume of the task.