Assigning severity to vulnerabilities is a very difficult problem.

This is exacerbated by the fact that most modern exploits are chains of multiple vulnerabilities.

I think a vulnerability should be scored based on the context where the most damage could be done.