Dependency track should consider removing EPSS or sharpen the message about the limitations

[prabhu]

EPSS model essentially looks for certain keywords and phrases in the description of a CVE to predict exploitability.

I am sure most dependency track users would agree that such a model doesn't really work and is only going to lead to false negatives where legitimate exploitable vulnerabilities (such as webp, iOS RCE, and 100 others) get deprioritized due to a lack of keywords and phrases.

I suggest either turning off this feature, making it an opt-in, or tuning up the message to encourage users to perform a thorough analysis and not rely on a single number for prioritization.