[pseudohadamard]

Thus CVE = Curriculum Vitae Enhancement. Have run into quite a lot of those.

A lesser one is where someone is obsessed with a particular issue and tries to find it in every piece of code they look at, even if it means modifying the code to create it or imagining its presence in the code. Run into some of those as well.

Trying to dispute stuff like this is an exercise in frustration. I know of several OSS maintainers who just take the hit and report the imaginary vulnerability as fixed in order to make the thing go away.