A long vulnerability list is not a patch plan. When a flaw has credible evidence of exploitation, it should move ahead of issues that are severe only on paper. CISA maintains the Known Exploited Vulnerabilities Catalog to help defenders prioritise vulnerabilities being used in the wild.
For a business, the first job is exposure: identify whether the affected product or version exists, who owns it, whether it is internet-facing and what the vendor recommends. Then set a remediation deadline, test the update or mitigation, and preserve evidence that the change was completed.
The catalog is an input, not a substitute for judgement. Business criticality and compensating controls still matter. But exploit evidence should create urgency and a named action—not another unread alert.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
