Which vulnerabilities should I fix first, and how should I fix them?