> It can be an incredible hassle to have a bullshit CVE "high" assigned to a project when you're dealing with various requirements and reporting. Exactly. Last

> It can be an incredible hassle to have a bullshit CVE "high" assigned to a project when you're dealing with various requirements and reporting. Exactly. Last year, multiple CVEs were opened against node.js. They only impacted an experimental feature introduced in node 20, but NVD listed all versions of node as vulnerable (in contradiction with NVD's own summaries!). Many security tools treat NVD's word as gospel and refused to issue a correction in their findings, even though the erroneous reports were obvious and verifiable. It took multiple weeks for NVD to fix the entries despite receiving no doubt many emails about it. Flaws in the CVE process waste tons of time, especially (it seems) at large orgs.