The popular open source project, 'ip' had its GitHub repository archived, or made "read-only" by its developer as a result of a dubious CVE report filed for his project. Unfortunately, open-source developers have recently been met with an uptick in debatable or outright bogus CVEs filed for their projects.
My main issue with CVEs nowadays is that it seems one gets generated even when 99% of the use cases for the software in question are not vulnerable as the vulnerability requires a very specific configuration/circumstances/etc. to be exploitable. In large projects with lots of dependencies this adds a lot of noice and there’s a risk that actual important CVEs go unnoticed.
We get some concerned folks asking about vulnerabilities on our software all the time because some dependency has a critical vulnerability and that gets our stuff flagged as having critical vulnerabilities too, even tho you need to opt-in to that dependency in compile time and even when it’s present it can only be abused by users with enough privilege to do directly much more than anything the vulnerability can end up doing.