I think the key problem is that people misunderstand what CVEs are. Ultimately CVEs are numbers given to a certain vulnerability. It helps so two people know t

I think the key problem is that people misunderstand what CVEs are. Ultimately CVEs are numbers given to a certain vulnerability. It helps so two people know they're talking about the same thing. A typical usecase would be that you have a security scanner that tells you your server is vulnerable to CVE-xxxx-xxxx and you can check the changelog of your server software which version fixes that. A CVE does not mean that a vulnerability is particularly important. It doesn't mean it's relevant for your use case. And a lot of CVEs does not mean the person who found them achieved something of significance. From a security perspective it makes sense to treat vulnerabilities that are minor and only relevant for rare use cases (or in combionation with other bugs) as vulnerabilities. But when you start counting vulnerabilities as achievements this distorts things. Plenty of shady security companies and research institutions making "statistics" about CVEs don't help either.