I guess the problem is that people use automated scanning tools, see CVE:s with high scores and then they go and put pressure on FOSS maintainers about stuff th

I guess the problem is that people use automated scanning tools, see CVE:s with high scores and then they go and put pressure on FOSS maintainers about stuff that’s a) not urgent b) doesn’t have a high impact?