Comment by my-huge-pony

CVSS is a terrible proxy for vulnerability real world impact. Not to mention, that CVE with CVSS 10.0 in Bob's Flower Names library with 5 users is probably not that important.