Cloudflare says it keeps severity and evidence of exploitation separate, since teams need both to decide. Coverage is selective: only issues Cloudflare chooses to brief on, focused on web apps, runtimes and libraries, and exposed services. Treat it as one more triage input alongside CISA KEV and vendor advisories, and check the vendor's own advisory before acting on a briefing.