vulnerability confirmation vulnerability prioritization CVSS CVE vulnerability classifications exposure factor vulnerability analysis environmental variables industry and organisation impact risk tolerance