Patches that have CVEs have a criticality rating. This determines how easy it is to exploit the security issue, and whether it is being done in the wild, with a CVE of 4 (or lower) generally not being a serious issue, but a CVE of 9-10 being a very serious one.
I recommend adding to the dynamic rules the ability to create rules where a CVE is greater than or equal to. This way, for an emergency vulnerability (let's say I define that as a CVE of 8 or higher), I can not just say "Has CVE", but "Has CVE greater than or equal to 8" to determine whether I want to patch in the middle of the day, even if that has interruptions, because it cannot wait. I may not wish to do so for a patch with a CVE of less than this; it can wait until evening after hours.
Excuse me....I wanted to mean with a CVSS score, not a CVE score.