Title: What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

You've taken a link (the article does not make your title claim) and phrased it as a fact.

> Yet only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation

That we know of

The other 99.5% are exploited on someone’s resume