>Exploit Code Maturity

>Unproven

>Remediation Level

>Official Fix

>Report Confidence

>Confirmed

I really like these secondary scoring factors, not just scoring the vuln itself, but how it's being attacked.