Vulnerability prioritization is big on that list. There are multiple studies that show that lack of correlation between CVSS and the exploitation risk, however, CVSS is probably still the most available metric appearing in pretty much every security scanner. And so people keep using CVSS as a primary prioritization metric.

The Payment Card Industry Data Security Standard (PCI DSS) of the PCI Security Council, requires the majority of Merchants (businesses that take credit or debit cards) to remediate all in-scope systems that score 4 or higher against the CVSS. The SSC mandates that an approved vulnerability scan is undertaken quarterly.

https://pci.qualys.com/static/help/merchant/network_scans/pci_severity_levels.htm

See:

https://swissmodel.expasy.org/docs/help