CVSS measures severity. CISA's KEV catalog records known exploitation. EPSS estimates the chance of exploitation in the next 30 days. Here's how to use all three without mistaking any one of them for risk.