“ A federally contracted research lab tracks all known security flaws in software and rates them by severity.” …where can one see this list?