Using vulnerability management data