> CVEs which are often not well-vetted and which can have exaggerated impact claims Hence the Yocto letter calling for approved tools to help the OSS community

> CVEs which are often not well-vetted and which can have exaggerated impact claims Hence the Yocto letter calling for approved tools to help the OSS community decentralize vetting.