Increase score for new-upstream builds that fix CVEs

We could probably get CVE data from UDD.

Cc @isomer