Vulnerability severity quantification