My main issue with CVEs nowadays is that it seems one gets generated even when 99% of the use cases for the software in question are not vulnerable as the vulnerability requires a very specific configuration/circumstances/etc. to be exploitable. In large projects with lots of dependencies this adds a lot of noice and there’s a risk that actual important CVEs go unnoticed.
We get some concerned folks asking about vulnerabilities on our software all the time because some dependency has a critical vulnerability and that gets our stuff flagged as having critical vulnerabilities too, even tho you need to opt-in to that dependency in compile time and even when it’s present it can only be abused by users with enough privilege to do directly much more than anything the vulnerability can end up doing.
