CVEs don't work all that well in standalone as proof of exploitability. It's always good to supplement with things like whether exploit tooling for said CVE ex

CVEs don't work all that well in standalone as proof of exploitability. It's always good to supplement with things like whether exploit tooling for said CVE exists (proof that there's some actual weakness behind the CVE) - or use data feeds like EPSS which rely on actual verified exploits to create their exploit probability score.