CRA reporting obligations explained

In just over a year, the first batch of CRA requirements will take effect: manufacturers will have to report actively exploited vulnerabilities contained in their products and severe incidents having an impact on the security of their products to ENISA, their member state, and the product&rsquo;s users. But what exactly is the difference between exploited vulnerabilities and severe incidents?