Why CVEs Are an Incentives Problem

**Executive Summary:** The piece argues that the recent surge in published CVEs is driven not only by improved discovery but also by misaligned incentives and weaknesses in the CVE/CVSS process (gaming for reputation, anonymous low-evidence filings, and poor correlation with real-world risk), and proposes reforms—rewarding higher-quality reports, enhancing verification and accountability, and adapting scoring to reflect exploitability—to restore signal and prioritization in vulnerability management.