Vulnerability disclosures have doubled year over year, and the people who must fix them are not scaling.