We have CVSS scores for grading vulnerabilities. So that could be useful as a start.