CVEs are conceptually not the worst thing, but when every time anyone uses a regex gets a CVE it stops being a useful metric real fast.