Consider SSVC for vulnerabilities prioritization

[pombredanne]

See https://github.com/CERTCC/SSVC/

But wait until this is resolved

• The license of the documentation is impractical for any use in any open source software, and other license issues CERTCC/SSVC#550