I don't know if you all know this but you don't have to fix CVEs. If the software author won't issue a fix, you are supposed to have an exemption process to ac

I don't know if you all know this but you don't have to fix CVEs. If the software author won't issue a fix, you are supposed to have an exemption process to accept the non-existent risk. In my view, the CVE system is too strict, it needs more noise and low severity vulns that are hard to pull off in the real world. It showd the scrutiny the software has gotten and seeing a lot of such vulns shows the software has good and secure design. Contrary to public sentiment, not having CVEs does not mean the software is secure, it most likely means (and you should presume) it hasn't gotten proper scrutiny. The main issue I have seen is how the scoring can be 9 or 10 without a working exploit. It's a database to help people make decisions not a compliance checklist. You should not misuse the databse alone to measure the how vulnerable you are, you should also be considering risk and impact as well as how fixable it is. But using it as a beating stick is far too easy.