The default type for representing vulnerabilities in STIX is CVRF1.1InstanceType in cvrf1.1_vulnerability.xsd