Vulnerability taxonomy