> I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. Indeed. It occurs to me that there's a

> I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. Indeed. It occurs to me that there's a possible feedback loop here. To the exent that NVD increases the severity of all (or even some) CVEs, they are effectively increasing the incentive for vendors to report lower severities, since the vendors may rightly assume that NVD will inflate the severity anyway.