Part of the problem is people who write up CVEs simply to get them on their resume. ("Curriculum Vitae Enhancement"?) The SQLite maintainers refuse to engage w

Part of the problem is people who write up CVEs simply to get them on their resume. ("Curriculum Vitae Enhancement"?) The SQLite maintainers refuse to engage with the CVE process, partially for this reason: "While the original idea being CVEs is sound, the current processes for creating and managing CVEs are inadequate. There are countless grey-hat hackers running fuzzers against a wide-variety of open-source software products (SQLite as well as many others) and writing up CVEs against any problems they find. The grey-hats are rewarded, sometimes with prestige and sometimes financially, by the number and severity of the CVEs they write. This incentive results in a proliferation of CVEs which are often not well-vetted and which can have exaggerated impact claims. The quality-control procedures for CVEs are unable to cope with this flood of inputs, making it difficult to correct exaggerated, misleading, omitted, or inaccurate claims." - https://www.sqlite.org/cves.html https://www.sqlite.org/cves.html