Sort vulnerability reports by evidence, not scores.
Recent revisions are kept. Restoring one creates a new revision.