Why CVSS Sucks and How To Do It Better