How to prioritize CVEs by application risk