Well said. This is another thing I wish I had expanded upon in the post: the "clout" that people chase with CVEs isn't considered particularly serious by the ac

Well said. This is another thing I wish I had expanded upon in the post: the "clout" that people chase with CVEs isn't considered particularly serious by the actually serious players in security. The contents of individual CVEs of course can be a source of cred, but the CVE itself is just an identifier (and brandishing it as anything more can be seen as gauche.)