A team wants to distinguish likely near-term exploitation from the general severity expressed by CVSS. Which additional input is useful?

1. Only the order findings appear in a PDF
2. Only the vendor logo's size
3. Only the number of characters in the CVE identifier
4. EPSS, known-exploited status, and local threat evidence