How do I prioritise thousands of open CVEs?
Order by evidence of exploitation, not by severity. Take anything with confirmed in-the-wild exploitation on an internet-facing system first, then high exploitation probability combined with real exposure, then everything else on a normal patch cycle. Severity scores describe worst-case impact and say nothing about whether a vulnerability is being used.
The failure mode is a backlog sorted by CVSS. It produces a list topped by Critical-rated flaws in products you barely run, while a moderately-rated bug in your edge device — the one being exploited this month — sits below the fold.
Three signals do most of the work: is it confirmed exploited, is the affected component actually reachable from outside, and is there a patch or vendor mitigation available. Those three collapse a five-figure backlog into a working list.
Everything else is scheduling. Once the urgent set is small and honest, the constraint stops being knowledge and becomes change control — which is a solvable operational problem rather than an unbounded reading task.