> I'm technically aware, but do I really have the expertise and bandwidth to tell the difference between an actual CVE and one that isn't, for the whole database?

I sure don’t. But who does? Who gets paid by whom to make this all work? Apparently whatever is happening now ain’t it.