I certainly find there are many people who take that naive view. The right thing to do is to triage them in your context and make your own risk assessment. Th

I certainly find there are many people who take that naive view. The right thing to do is to triage them in your context and make your own risk assessment. The CVSS numbers are a guide to which ones you should prioritise looking at, but not a risk assessment. However, in the security and risk world, you have to take a worst case view in the absence of further reliable information. This can lead to fixing things that maybe don't really need fixing, even when a triage has been done. It's often hard to discover enough reliable information.