Vulnerability scoring would be better with two scores: one for impact -- how many people are affected -- and urgency -- how quickly they need act to address the issue