Drop everything.
Critical CVEs that are confirmed exploited or very likely to be. Newest first.
Nothing matches. Even the internet can't break that way. Try fewer filters.
A CVE is listed as major when it is critical (CVSS 9.0 or higher) and either confirmed exploited in the wild with a real chance of more, or very likely to be exploited (EPSS 40% or more).