The bogus CVE problem

As a source of names for bugs it has served its purpose well, so not every vulnerability needs to get a vanity exploit name, and the ones that anybody cares about, you can generally remember them by number until they fade into obscurity (one hopes). The ones that are bogus or that don't merit attention? No inherent problem with them having names, just like one is free to name one's imaginary friends.

After all, remember the first of the 3 hardest problems in computer science.

As the key to databases (NVD, the CVE-named errata pages of RedHat, Debian security-tracker, etc.) with links to advisories and/or references, it's kinda useful to have them be content-addressable.

As long as one can ignore everything else, which I guess it's hard for somebody to do if a CVE is kind of like an unsealed indictment of your software product, ... hmm.

Maybe there needs to be a CVE-rank algorithm to score CVEs: If there are no vendor and/or distro and/or vulnerability-list and/or such links attached to, say, the NVD entry, then it should carry a low score and people should ignore it (should the score stay low). And if the score doesn't respond dynamically enough to reflect some really bad news? Well, if you're looking to track CVSS scores to tell you what advisories to pay attention to in your system, then I got nothing for you. But if you're only responding to some vulnerability scanner telling you which high-CVSS things you need to worry about, then it's the scanner's problem, not yours, and you can maybe go back to figuring out your most significant risks and how to balance them yourself.

Not sure if that would be very open to gaming (CVEO?) but also hard to see the point. I don't flatter myself that I'm very devious, though.