CVSS measures how severe a vulnerability *could* be, based on its technical traits, giving a score from 0 to 10. EPSS predicts the *likelihood* that a vulnerability will be exploited in the real world ...