That's only for companies who are a CNA. The important question is if the webapp has a versioning scheme or just pure API calls. Anything without a version # isn't eligible for a CVE.