How authoritative and comprehensive is NIST's CPE, as a list of applications, hardware and operating systems? It's clearly a vast labour for which I am grateful, but I need to know how good it is.
Specifically, I am wondering about coverage of manufacturers (inclusion seems a bit optional, particularly for Open Source), products, depth of versions (e.g. RHEL 6.x sub-versions all listed but version 5 mentioned without sub-version lists), naming (e.g. Red Hat vs RedHat), and currency (how quickly do new products find their way into the list?)