How long each vulnerability took to handle, against the targets you set per severity, and the dated evidence log.

The CRA asks you to address vulnerabilities without delay (Annex I, Part II). Correction times measures how long you actually take, against the targets you set, and gives you a dated record of it. It is part of the paid plans.

Open Correction times, under Report. For each severity, and for actively exploited vulnerabilities, you see the target, how many were handled over the last 12 months, how many within the target, the median time, and how many are still open or overdue.
Below, the overdue vulnerabilities, the longest past their target first.
Owners and admins set the targets in whole days, from 1 to 365. By default: 7 days for an actively exploited vulnerability or a critical one, 30 for high, 90 for medium, 180 for low. Leave a box empty for no target. Each change is recorded in the evidence journal.
Click Download the evidence log (CSV): one line per vulnerability, with when its clock started, how and when it was handled, the days taken and the target. Its SHA-256 fingerprint is recorded in the evidence journal, so you can show later that a copy has not been changed.

How it is measured. One vulnerability is one advisory in one component version of one product, as a VEX statement is. The clock starts when the watch first found it in the product; for an actively exploited one, from the moment a catalogue (CISA KEV, EUVD) first flagged it, and the exploited target applies whatever its severity. It is handled when you assess it as not affected or fixed (at the date you first closed it: editing the text later does not move it), or when no supported release of the product contains it any more (when the watch found it gone). Under investigation and affected keep it open. A vulnerability assessed before a catalogue flagged it as exploited is judged in its own severity. The severity is the latest one: a vulnerability raised to critical is measured against the critical target. Vulnerabilities without a severity are counted only once exploited, and those left open in an archived product count nowhere.

Nothing is stored for this page: it is computed each time from the watch’s findings and your VEX statements.