What should I fix first?

Ranked by computed risk — CVSS severity, real-world exploit probability (EPSS), active exploitation, asset criticality and internet exposure. Not just sorted by CVSS.