Just 2.6% of 2019's 18,000 tracked vulnerabilities were actively exploited in the wild