The CVE system...has lately attracted a segment of community members filing unverified reports. While many of the CVEs are filed in good faith ... a recently g

The CVE system...has lately attracted a segment of community members filing unverified reports. While many of the CVEs are filed in good faith ... a recently growing pattern involves newbie security enthusiasts and bug bounty hunters ostensibly "collecting" CVEs to enrich their resume The potential downward spiral: Projects that receive an inappropriate CVE get defended by their devs. Some devs have more success at this. Their language and methods are parroted by unscrupulous actors - like entities who buy/usurp control of a repository for malicious means. If we get here, the likely outcomes seem to be: 1) CVE reporting authorities recognize the problem and tighten up reporting procedures (to mostly good ends) or 2) The people who properly depend on CVEs become increasingly exhausted trying to validate their integrity; they devalue and depend on them less. This further accelerates CVE's lack of trustworthiness and gives bad actors wider room to operate.