They definitely stack. I'm guessing it's multiplicative, not additive, but that's a total guess. If you're hitting a vuln you're doing 4/3 what you'd do without the vuln. So two vulns would be 16/9 * normal.