What do the CVE Shield status values mean?

Not seen means the CVE hasn't been detected in your application yet. Exposed means the CVE is present and the vulnerable code path is in use, but no attack has been detected. Exploited means an attack against this CVE was detected and succeeded. Two more states, Protecting and Blocked, describe active shielding of a CVE. They're not available yet, CVE Shield doesn't support blocking on any tier at launch.

See: Review CVE Shield states (product docs: https://docs.contrastsecurity.com/en/review-cve-shield-states.html)