NIST announces big changes to the way it categorises and manages CVEs, set to have a big impact on how organisations manage patching and remediation.