Does vulnerable stack and if so how?
No it does not.
After testing with a friend, he playing Brightwing and myself playing Nova I can definitely say that the vulnerability debuff does NOT stack. The test was done once reaching level 20 on a Merc camp. Snipe with no debuff hit for 845, with Pinning Shot for 1057 and with both Poly and Pinning Shot also for 1057.
However there was some speculation on this as shown below.
According to a Reddit post and a post in the Blizzard forums, people have seen these affects stacking, what isn't currently clear is whether or not this was a bug that was since fixed, or if it is intended, whether the stacking is additive or multiplicative*
Relevant snippet from forum post:
They do stack, I played a few custom games with a friend a while back. Nova's Crippling Shot and Hunter's Mark stack. Along with Jaina's CoC and BW's Poly.
Thay may have changed it this patch to allow only 1 vulnerability Debuff, but this does not affect Tyrande's hunter's mark as that is a different debuff entirely.
*This would require some very constrained tests in a training match I imagine, or a Blue answer on the forum
Blizzard has changed how damage mitigation and vulnerability works (as of January 2017). There are now three types of armor:
- Physical Armor: resistance to basic attacks
- Spell Armor: resistance to Spell/Ability damage
- Armor: resistance to all damage
Each category is tracked separately and capped at [-25, +75]. Vulnerability effects so far are applied equally to all three armor values. The cap on vulnerability is -25%. Multiple effects will stack additively. For example, multiple vulnerability effects on a single hero can bring their positive armor value down.
Although the armor values are capped, certain talents can go beyond them. For instance, Nazeebo's Superstition talent will reduce his Physical Armor (resistance to basic attacks) to -30%. Here is a Blizzard post from 1/6/2017, explaining the new armor system.