Knowing which vulnerability to fix first

Common Vulnerability Scoring System (CVSS) severity tells you how serious a vulnerability could be. Exploit Prediction Scoring System (EPSS) estimates how likely exploitation is in the next 30 days. Neither one, by itself, tells you what your team should fix first.