I think the whole CVE/CVSS system is completely outdated, and it doesn't reflect the reality of software making for a while now (years). Also. for years, major software providers have been fighting to control their own release logs and security vulnerabilities. Recently, NIST stopped actually analyzing CVE's (one can relate to that), and the fact is that the system only makes sense as 1) vuln database; 2) in the context of responsible discosure; Responsible disclosure is from a non-AI era, where the time between a finding and a release woulds be measured in months, not weeks. Also, from a time where the probability of another human to stumble on that specific vulnerability was quite low. Pre-AI times.

Also, in April 2025 MITRE announced that fundings to the CVE/CWE program would expire, and it took a couple of days for the Trump administration to backpedal from that. We need a global system, not an american one - and clearly, americans should not be in charge of these global programs, as there is no way to isolate the world from their local politics. Their programs, their funding, nothing against it. I just think we, collectively, should have something a bit more robust, and while at it, do it on a quite more modern basis (EU CRA is actually a good start, as it includes SBOM and mandatory reporting).

CVE, CVSS, CPE seem all designed by comittee; CVSS and CPE are a flagrant case of that (try to apply CPE versioning to your own software, you'll get it); Its "what we have now" - there are alternatives, afaik but not that mainstream.