2. Has anyone started taking CVEs (or disclosures the vendor isn't acknowledging with a CVE) and give sample queries? >90% are just checking version - the config issue bugs would be the more interesting.