They're a conflation of multiple lifecycle states: reported, confirmed, disclose...

		cvccvroomvroom on Sept 6, 2023 \| parent \| context \| favorite \| on: Now it's PostgreSQL's turn to have a bogus CVE They're a conflation of multiple lifecycle states: reported, confirmed, disclosed, patch available, and exploit available. Perhaps the simplest way to reduce noise is to have 2 numbering systems: provisional "prepress" PCVE and confirmed CVE.