Man, I'm torn on this one. I work at a reasonably large shop where we are required to take these CVE scores seriously. I do see a bunch that are really not ap

Man, I'm torn on this one. I work at a reasonably large shop where we are required to take these CVE scores seriously. I do see a bunch that are really not applicable every single day. (The dude from Mitre has earned a special place in hell for https://nvd.nist.gov/vuln/detail/cve-2016-1000027 https://nvd.nist.gov/vuln/detail/cve-2016-1000027) When I look at images where there are thousands of issues... it almost always is something end of life that is not supported. Our folks should not be using it. General rule of thumb, if you see an issue that you can patch - do so. There should be enough automation/testing so that minor version ++ is not a scary event. The real challenge is getting the business side to understand they need to allow time for updating. A SpringBoot 1.2 app might work just fine, from a functionality perspective. We try to use the CVE cleanup as a tech debt indicator to make sure folks are finding the time to upgrade from Java 5. Crazy, right? Most folks just use a docker image. Few actually build them or know enough to maintain someone elses. Surprisingly rare skill.