As a follow up for #149, we should check a random sample of CVEs reported in GLVD for plausibility
Most important is if the issue is marked as 'vulnerable' (including the changelog auto-triage) and if that meets the expectation.
If issues come up, they need to be addressed.
