I got out of vulnerability management ~10 years ago and moved into other domains where I didn't really work around CVEs and vulnerability reporting. I dipped my toes back in late last year and couldn't believe that basically nothing had changed.