Known exploited vulnerabilities

Evidence that something is actually being exploited beats a high theoretical severity every time.

Most published flaws are never used against anybody. A small proportion are used against everybody, quickly. Catalogues of known exploited vulnerabilities exist to separate those two groups, and they are the single most useful input to deciding what to fix first. It is the difference between prioritising by how bad something could be and prioritising by what is happening now.