New posts in Vulnerability Management

Should a vulnerability in a service that is present on the device, but not running and not used at all, be mentioned in the vulnerability report?

What risk rating models are used for calculating risk scores of web vulnerabilities?