During analysis of a vulnerability scan for an internet-facing web application server, a penetration tester finds several high and critical CVSS-rated findings. The client has limited remediation capacity and asks the tester which vulnerability should be addressed first. All findings have similar CVSS base scores. Which additional data source should the tester consult to identify vulnerabilities that are being actively exploited in the wild by threat actors?