Funnily enough the current webp situation is the perfect counterpoint and sort of speaks to the fairly unregulated way CVEs are assigned. Multiple CVEs for the

Funnily enough the current webp situation is the perfect counterpoint and sort of speaks to the fairly unregulated way CVEs are assigned. Multiple CVEs for the same core issue playing havoc and hampering remediation. A more robust system would indeed promise that we're all talking about "the same bug"; we aren't, currently. Then there's the erroneous CVEs closer to what OP is talking about, like more recent CVEs registered for deliberately vulnerable apps like OWASP Juice Shop etc. In practice, the current system gets a lot right, but its lack of scrutiny creates issues.