What do the CVE Shield status values mean?

Not seen means the CVE hasn't been detected in your application yet. Exposed means the CVE is present and the vulnerable code path is in use, but no attack has been detected. Exploited means an attack against this CVE was detected and succeeded. Two more states, Protecting and Blocked, describe active shielding of a CVE.  CVE Shield Free tier doesn't support blocking.

See: Review CVE Shield states (product docs: https://docs.contrastsecurity.com/en/review-contrast-cve-shield-states.html)