Tag risk-based vulnerability management