Interesting comments on CVSS with regards to curl.

I’ve used CVSS much more than published but also find them frustrating when there is expert local knowledge fighting with broad corporate policy. They’re fine as a component in figuring out risk but not the one answer.