A lot of times it’s made up because security teams don’t have resources to actually risk assess vulnerabilities especially in upstream sources. They’ll just tak

A lot of times it’s made up because security teams don’t have resources to actually risk assess vulnerabilities especially in upstream sources. They’ll just take the CVE at face value which we know is wrong and sometimes not even reachable. But a lot of times there’s legit problems and a lot of times newer code is safer anyways. You just can’t know unless you spend a lot of time and money. It’s best just to patch and toss stuff that is on the network that isn’t supported anymore.