@michael @YoungImpAngel @campuscodi @splinux
As you rightly point out, there are 37,558 false positives or duplicates.

Regarding the remainder, we know they were accepted as CVEs, but we do not know:

* the risk rating for each of those 442 entries;
* which ones affected active library versions;
* the conditions required to exploit the vulnerability.

1/2