@joshbressers I tried.
https://cve.mitre.org/data/board/archives/2017-03/msg00016.html
https://cve.mitre.org/data/board/archives/2018-11/msg00003.html
and so on. I was ahead of my time or something.
With respect to services we'll get whatever the service providers give us with respect to CPE/CWE/etc. there's no way to reliably figure this out externally.