1. A computer-implemented method, comprising: receiving, by a computer, data describing a first software component used by a software product; receiving, by the computer, vulnerability data describing a vulnerability in the first software component; calculating, by the computer, a vulnerability score for the software product, based upon the vulnerability data for the first software component; receiving, by the computer, an updated status of the vulnerability in the first software component, wherein the updated status reflects an approved waiver of the vulnerability in the first software component or changed bug status from bug tracking software; recalculating, by the computer, the vulnerability score for the software product based upon the updated status; and presenting, by the computer, the recalculated vulnerability score for the software product to a display device to a user.