You got a point with NVD but this case shows how one could damage the reputation of a product - this really looks like Bagder didnt care about security, even the 2020 prefix is a bad sign looking from the outside. I am not sure how the NVD define CVE scores but as bagder openly explains this isnt a flaw in security, just a bug he already fixed years ago.
Postfix! I worked at an E-commerce company that sent newsletters(spam) through shitty Windows SMTP servers. Looking for speed and some other neat things (DKIM and modify headers) I setup postfix on Debian and I guess this system is still running. Quickly after that I explored NGINX as a reverse proxy for yet again shitty Windows IIS webservers. This was my entry to open source and Linux in general.