other than the obvious whats the priority for fixing bugs/exploits?

is it well documented first? those that are easy to reproduce?