@bagder As a way of saying how old I am without saying how old I am. Mitre used to have a mechanism that potential issues were assigned a CAN-number. Then the elite would vote if it was indeed a vulnerability. If so, a CAN would become a CVE. Of course this soon became a mess as the CANs piled up and checking if a CAN ended up as CVE just for reference became a dreadful chore. I guess you’re on the accepted risk end of the choice made to end the CAN/CVE naming and stick with CVE.