1. A computer-implemented method, comprising: receiving, by a computer, data describing a first software component used by a software product; receiving, by the computer, vulnerability data describing first and second vulnerabilities in the first software component; calculating, by the computer, a vulnerability score for the software product, based upon the vulnerability data for the first software component; receiving, by the computer, an updated status of the first and second vulnerabilities in the first software component, wherein receiving the updated status includes receiving an approved waiver of the first vulnerability in the first software component and wherein the updated status reflects that the second vulnerability has been remediated by patching or revising the software component or the software product; receiving, by the computer, an update indicating that a second software component is no longer used by the software product; recalculating, by the computer, the vulnerability score for the software product based upon the updated status of the first and second vulnerabilities and based upon the update that the second software component is no longer used by the software product; and presenting, by the computer, the recalculated vulnerability score for the software product to a display device to a user.