prioritizing vulnerabilities