only list RHSAs in the list of 'RHSAs - CVSS >= limit'; it seems there are RHBAs relevenat to certain CVE and has CVSS score
rename existing rk-updateinfo  (rpmkit.extras.updateinfo) to rk-updateinfo-legacy, and now rk-updateinfo is rpmkit.updateinfo based