There is no universe in which the CVE database is going to be reliable as a source of analytical data about vulnerabilities. It exists to provide a common vocabulary in discussions about specific vulnerabilities, and that is literally all it can do (& even then...). It is gamed six ways from Sunday by practitioners, and nothing is going to stop that from happening, because the project isn't staffed adequately to meaningfully adjudicate, let alone analyze, all the vulnerabilities that get filed, and nobody in the industry is remotely interested in funding such a body.

So, however valid these complaints may be, they fundamentally misconstrue the role of NVD. They're taking NVD artifacts far too seriously. I'm sure that's a reaction to incompetents in the security industry also misconstruing NVD, but the correct response to that is to dunk on those incompetents, not to attempt to hold NVD to an impossible standard.

Meanwhile, the CVSS is bad? You don't say. On this point, Stenberg's right to make noise: there is a broad (if quite shallow) belief that CVSS scores have some meaning, and they do not: they are a Ouija board that reflect the interests of whoever calculated the score, and it's easy to show pairs of sev:lo-sev:hi vulnerabilities that illustrate exactly how ridiculous the resulting scores are.

It would be better if the NVD CVE database didn't include CVSS scores; they don't work, they're unscientific, and they too hold NVD to a standard they can't possibly meet, making a lot of this their fault.