This analogy is flawed. Bug reports are opened and then, after they get a number, are triaged. CVE numbers are applied for, and then separately they are grant

This analogy is flawed. Bug reports are opened and then, after they get a number, are triaged. CVE numbers are applied for, and then separately they are granted only sometimes. A CVE number being granted means that an organization, a relevant CNA[0] for the project in question, has confirmed that they think it is a real security issue. MITRE says CVE IDs indicate a real vulnerability, not "reports that have not been triaged yet", so clearly it's intended that they're mostly valid. It is true that you have to think critically about CVEs, obviously, but I don't think it's helpful to excuse MITRE for this by saying "no, actually, the numbers were never meant to mean anything", when they themselves have never held that stance. [0]: https://www.cve.org/ProgramOrganization/CNAs https://www.cve.org/ProgramOrganization/CNAs