Some CVEs have no base score assigned from the NIST, but have a score defined from github

[refoo0]

We should include github basescores, if there is currently no base score from the nist available.

Example: https://nvd.nist.gov/vuln/detail/CVE-2024-34351

https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g

[timbastin]

I think we should at least take a look at this. I am fine with "not doing it after evaluating the necessary efforts and outcomes".