What happens once a vulnerability has been added to a database? That is, what can we (security/IT professionals) do about it? How do we find out what to do?
Giving it a CVE number (and adding it to a database) is just giving it a common name that can be used to refer to it. By itself, it does nothing.
But by that point, the people who have requested a CVE number be assigned to the vulnerability, have studied it and have prepared recommendations: a patch, a configuration workaround, a recommendation to shut off some software/hardware pending a fix.
What you do as a professional is up to you. You can decide to do nothing, or to apply the patch to all nodes, or to apply the patch in lab and see if it breaks something, or to switch vendors.