As far as I know, there's no "CVE grading people". The submitter of the CVE decides on the severity. You probably can appeal to MITRE folks if it's hilariously

As far as I know, there's no "CVE grading people". The submitter of the CVE decides on the severity. You probably can appeal to MITRE folks if it's hilariously inaccurate but I think that's how it mostly works.