I don't know why he assumes NVD is a big organization. I'd be surprised if they occupied a full floor. They're most likely understaffed and underpaid, which is

I don't know why he assumes NVD is a big organization. I'd be surprised if they occupied a full floor. They're most likely understaffed and underpaid, which is not a good start for a mistake free environment. But his point stands it would definitely be much better if they triple checked when scoring stuff that is universally deployed like curl, zlib or SQLite. That and the fact that CVSS is mostly useless.