I scanned a site using vulnerability scanner and got a CVV score 10 vulnerability. Should I send the report to the company?