It's generally accepted that open published CVEs push vendors to actually patch their software, instead of covering up and ignoring bugs. It also gives you a he

It's generally accepted that open published CVEs push vendors to actually patch their software, instead of covering up and ignoring bugs. It also gives you a heads up that the software your running has an issue and you need to update. It's tempting to think that making this knowledge publicly available gives the bad guys a roadmap, but in security you really can't just assume that because a vulnerability isn't public knowledge the bad guys won't know about it. Frankly with the proliferation of the vulnerability black market, lack of public disclosure of CVEs would mean that only the black hats know it.