CVE vs CVSS
CVE names a vulnerability. CVSS scores a model of severity. Neither tells you if you are exposed or if it is being used.
CVE is an identifier. CVSS is a 0 to 10 score with a vector. EPSS estimates exploitation probability. CISA KEV records known exploitation.
A 9.8 on an internal printer driver is not your week. A 7.5 on an internet-facing gateway that is in KEV is.
Patch policy should combine: is it exploited, is the asset exposed, what is the asset worth, is there a mitigation. CVSS alone is a sorting hat for auditors.