[fulafel]

Lack of an assigned CVE is a really bad reason to discount anything, it's a bureucratic process with various tangential limitations, rules and delays.

[krzyk]

CVEs are frequently created for minor issues, like the recent Jackson bug that has very specific (and not frequent) case.