I scanned a site using a vulnerability scanner and it found a vulnerability with a CVV score of 10. Should I send the report to the company?