being actively exploited or detected in real-world enterprises.
2) More precise classification could be informative. Approximately
15% of CVEs have vulnerability types that cannot be described
using the current classification scheme. Another 10% are