Having your name on a severe CVE is the new having your name on a patent. The incentives are set up not to improve security, but to generate reports. Companies

Having your name on a severe CVE is the new having your name on a patent. The incentives are set up not to improve security, but to generate reports. Companies will pay bounties to their employees for finding CVEs, even if they aren't the owners of the code. Result: thousands of meaningless CVEs that drown out real security issue in the noise.