@blamejs/exceptd-skills 0.18.29 → 0.18.30

package/data/cve-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-08-06",
+    "last_updated": "2026-08-08",
     "source": "NVD + CISA KEV + vendor advisories — see sources/index.json",
     "required_fields": [
       "type",
@@ -303,9 +303,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.",
-    "epss_score": 0.12685,
+    "epss_score": 0.71391,
     "epss_percentile": 0.95846,
-    "epss_date": "2026-07-28",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-16232",
     "vendor_advisories": [
       {
@@ -381,7 +381,8 @@
       "reboot_required": 5
     },
     "rwep_score": 75,
-    "rwep_notes": "RWEP 75. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +20, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 75. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +20, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-50522": {
     "name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ",
@@ -397,9 +398,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
-    "epss_score": 0.57101,
+    "epss_score": 0.7576,
     "epss_percentile": 0.98975,
-    "epss_date": "2026-07-28",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-50522",
     "vendor_advisories": [
       {
@@ -478,7 +479,8 @@
       "reboot_required": 5
     },
     "rwep_score": 81,
-    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-32315": {
     "name": "Ignite Realtime Openfire Path Traversal Vulnerability",
@@ -1309,9 +1311,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.",
-    "epss_score": 0.54538,
+    "epss_score": 0.46709,
     "epss_percentile": 0.98914,
-    "epss_date": "2026-07-28",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-37580",
     "vendor_advisories": [
       {
@@ -1388,7 +1390,8 @@
       "reboot_required": 0
     },
     "rwep_score": 62,
-    "rwep_notes": "RWEP 62. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +12, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 62. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +12, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-38606": {
     "name": "Apple Multiple Products Kernel Unspecified Vulnerability",
@@ -11733,9 +11736,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Windows Kernel Elevation of Privilege Vulnerability",
-    "epss_score": 0.51865,
+    "epss_score": 0.5981,
     "epss_percentile": 0.98833,
-    "epss_date": "2026-07-20",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21338",
     "vendor_advisories": [
       {
@@ -11808,7 +11811,8 @@
       "reboot_required": 5
     },
     "rwep_score": 79,
-    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-29360": {
     "name": "Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability",
@@ -13900,8 +13904,8 @@
     "complexity": "low",
     "vector": "The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.",
     "epss_score": 0.01145,
-    "epss_percentile": 0.63213,
-    "epss_date": "2026-07-20",
+    "epss_percentile": 0.68783,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-41990",
     "vendor_advisories": [
       {
@@ -13980,7 +13984,8 @@
       "reboot_required": 5
     },
     "rwep_score": 61,
-    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-27524": {
     "name": "Apache Superset Insecure Default Initialization of Resource Vulnerability",
@@ -20733,8 +20738,8 @@
     "complexity": "low",
     "vector": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
     "epss_score": 0.01296,
-    "epss_percentile": 0.67106,
-    "epss_date": "2026-07-16",
+    "epss_percentile": 0.92603,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-58644",
     "vendor_advisories": [
       {
@@ -20806,7 +20811,8 @@
       "reboot_required": 0
     },
     "rwep_score": 56,
-    "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-25089": {
     "name": "Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089)",
@@ -20822,9 +20828,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",
-    "epss_score": 0.23393,
+    "epss_score": 0.73603,
     "epss_percentile": 0.97528,
-    "epss_date": "2026-07-16",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-25089",
     "vendor_advisories": [
       {
@@ -20900,7 +20906,8 @@
       "reboot_required": 5
     },
     "rwep_score": 57,
-    "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-39808": {
     "name": "Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808)",
@@ -20916,9 +20923,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "OS command injection in the FortiSandbox management interface (CWE-78). An unauthenticated attacker injects shell metacharacters into the `jid` parameter of the /fortisandbox/job-detail/tracer-behavior endpoint; the value reaches an underlying OS command without sanitization, yielding remote code execution as root. Affects FortiSandbox 4.4.0 through 4.4.8 and FortiSandbox PaaS builds. Reconstructed from the Fortinet PSIRT advisory (FG-IR-26-100) and public exploitation reporting, as the upstream NVD record shipped without a documented attack vector.",
-    "epss_score": 0.48668,
+    "epss_score": 0.9121,
     "epss_percentile": 0.9874,
-    "epss_date": "2026-07-16",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-39808",
     "vendor_advisories": [
       {
@@ -20994,7 +21001,8 @@
       "reboot_required": 5
     },
     "rwep_score": 79,
-    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-46817": {
     "name": "Oracle E-Business Suite Improper Privilege Management Vulnerability",
@@ -21012,9 +21020,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments.  Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
-    "epss_score": 0.01045,
-    "epss_percentile": 0.60266,
-    "epss_date": "2026-07-16",
+    "epss_score": 0.13309,
+    "epss_percentile": 0.96021,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-46817",
     "vendor_advisories": [
       {
@@ -21100,7 +21108,8 @@
       "reboot_required": 0
     },
     "rwep_score": 53,
-    "rwep_notes": "RWEP 53. cisa_kev +25, active_exploitation +20, blast_radius +23, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 53. cisa_kev +25, active_exploitation +20, blast_radius +23, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-4346": {
     "name": "KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability",
@@ -21208,8 +21217,8 @@
     "complexity": "low",
     "vector": "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.",
     "epss_score": 0.00379,
-    "epss_percentile": 0.30157,
-    "epss_date": "2026-07-16",
+    "epss_percentile": 0.81925,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-56155",
     "vendor_advisories": [
       {
@@ -21280,7 +21289,8 @@
       "reboot_required": 5
     },
     "rwep_score": 57,
-    "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-56164": {
     "name": "Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability",
@@ -21296,9 +21306,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.",
-    "epss_score": 0.05601,
-    "epss_percentile": 0.92028,
-    "epss_date": "2026-07-16",
+    "epss_score": 0.22439,
+    "epss_percentile": 0.97467,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-56164",
     "vendor_advisories": [
       {
@@ -21376,7 +21386,8 @@
       "reboot_required": 5
     },
     "rwep_score": 61,
-    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-15409": {
     "name": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
@@ -21392,9 +21403,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.",
-    "epss_score": 0.01266,
-    "epss_percentile": 0.66447,
-    "epss_date": "2026-07-16",
+    "epss_score": 0.7844,
+    "epss_percentile": 0.99541,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-15409",
     "vendor_advisories": [
       {
@@ -21467,7 +21478,8 @@
       "reboot_required": 5
     },
     "rwep_score": 61,
-    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-15410": {
     "name": "SonicWall SMA1000 Appliances Code Injection Vulnerability",
@@ -21483,9 +21495,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.",
-    "epss_score": 0.01486,
-    "epss_percentile": 0.71117,
-    "epss_date": "2026-07-16",
+    "epss_score": 0.76347,
+    "epss_percentile": 0.99489,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-15410",
     "vendor_advisories": [
       {
@@ -21556,7 +21568,8 @@
       "reboot_required": 5
     },
     "rwep_score": 56,
-    "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +21, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +21, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2008-4128": {
     "name": "Cisco IOS Cross-Site Request Forgery Vulnerability",
@@ -21573,9 +21586,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.  NOTE: some of these details are obtained from third party information.",
-    "epss_score": 0.23857,
+    "epss_score": 0.32953,
     "epss_percentile": 0.97573,
-    "epss_date": "2026-07-16",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2008-4128",
     "vendor_advisories": [
       {
@@ -21652,7 +21665,8 @@
       "reboot_required": 5
     },
     "rwep_score": 70,
-    "rwep_notes": "RWEP 70. cisa_kev +25, active_exploitation +20, blast_radius +20, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 70. cisa_kev +25, active_exploitation +20, blast_radius +20, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2020-14644": {
     "name": "Oracle WebLogic Server Remote Code Execution Vulnerability",
@@ -30133,9 +30147,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.",
-    "epss_score": 0.00836,
-    "epss_percentile": 0.53473,
-    "epss_date": "2026-07-11",
+    "epss_score": 0.76066,
+    "epss_percentile": 0.99485,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-56291",
     "vendor_advisories": [
       {
@@ -30208,7 +30222,8 @@
       "reboot_required": 0
     },
     "rwep_score": 65,
-    "rwep_notes": "RWEP 65. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 65. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-48939": {
     "name": "iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -30224,9 +30239,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.",
-    "epss_score": 0.01505,
-    "epss_percentile": 0.71365,
-    "epss_date": "2026-07-11",
+    "epss_score": 0.82501,
+    "epss_percentile": 0.99634,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48939",
     "vendor_advisories": [
       {
@@ -30300,7 +30315,8 @@
       "reboot_required": 0
     },
     "rwep_score": 63,
-    "rwep_notes": "RWEP 63. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +13, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 63. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +13, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-56290": {
     "name": "Joomlack Page Builder Improper Access Control Vulnerability",
@@ -30316,9 +30332,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.",
-    "epss_score": 0.02912,
-    "epss_percentile": 0.85373,
-    "epss_date": "2026-07-11",
+    "epss_score": 0.83254,
+    "epss_percentile": 0.9965,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-56290",
     "vendor_advisories": [
       {
@@ -30391,7 +30407,8 @@
       "reboot_required": 0
     },
     "rwep_score": 62,
-    "rwep_notes": "RWEP 62. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +12, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 62. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +12, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-55255": {
     "name": "Langflow Authorization Bypass Through User-Controlled Key Vulnerability",
@@ -30407,9 +30424,9 @@
     "active_exploitation": "confirmed",
     "complexity": "high",
     "vector": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.",
-    "epss_score": 0.00467,
-    "epss_percentile": 0.37303,
-    "epss_date": "2026-07-11",
+    "epss_score": 0.29052,
+    "epss_percentile": 0.97979,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-55255",
     "vendor_advisories": [
       {
@@ -30486,7 +30503,8 @@
       "reboot_required": 0
     },
     "rwep_score": 65,
-    "rwep_notes": "RWEP 65. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 65. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-48908": {
     "name": "JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -30502,9 +30520,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.",
-    "epss_score": 0.01569,
-    "epss_percentile": 0.72455,
-    "epss_date": "2026-07-11",
+    "epss_score": 0.8813,
+    "epss_percentile": 0.99752,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48908",
     "vendor_advisories": [
       {
@@ -30578,7 +30596,8 @@
       "reboot_required": 0
     },
     "rwep_score": 68,
-    "rwep_notes": "RWEP 68. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 68. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +18, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-48282": {
     "name": "Adobe ColdFusion Path Traversal Vulnerability",
@@ -30594,9 +30613,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",
-    "epss_score": 0.28583,
+    "epss_score": 0.99197,
     "epss_percentile": 0.97907,
-    "epss_date": "2026-07-11",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48282",
     "vendor_advisories": [
       {
@@ -30673,7 +30692,8 @@
       "reboot_required": 0
     },
     "rwep_score": 74,
-    "rwep_notes": "RWEP 74. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 74. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-23209": {
     "name": "Craft CMS Code Injection Vulnerability (CVE-2025-23209)",
@@ -38018,9 +38038,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.",
-    "epss_score": 0.32568,
+    "epss_score": 0.23184,
     "epss_percentile": 0.98139,
-    "epss_date": "2026-07-11",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-9680",
     "vendor_advisories": [
       {
@@ -38110,7 +38130,8 @@
       "reboot_required": 0
     },
     "rwep_score": 50,
-    "rwep_notes": "RWEP 50. cisa_kev +25, active_exploitation +20, blast_radius +20, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 50. cisa_kev +25, active_exploitation +20, blast_radius +20, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2024-30088": {
     "name": "Microsoft Windows Kernel TOCTOU Race Condition Vulnerability",
@@ -38685,9 +38706,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Microsoft Management Console Remote Code Execution Vulnerability",
-    "epss_score": 0.60954,
+    "epss_score": 0.66571,
     "epss_percentile": 0.99047,
-    "epss_date": "2026-07-11",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-43572",
     "vendor_advisories": [
       {
@@ -38763,7 +38784,8 @@
       "reboot_required": 5
     },
     "rwep_score": 81,
-    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2024-43047": {
     "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2024-43047)",
@@ -39576,8 +39598,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=24. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.03219,
-    "epss_date": "2026-07-03",
+    "epss_score": 0.0912,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-45659",
     "cwe_refs": [
@@ -39619,7 +39641,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-48558": {
     "name": "SimpleHelp Authentication Bypass Vulnerability",
@@ -39680,8 +39703,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=20. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.0116,
-    "epss_date": "2026-07-03",
+    "epss_score": 0.11484,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48558",
     "cwe_refs": [
@@ -39723,7 +39746,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 10 and CWE(s) CWE-347 retained; ATT&CK + IOCs derived from the Auth-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 10 and CWE(s) CWE-347 retained; ATT&CK + IOCs derived from the Auth-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-26633": {
     "name": "Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability",
@@ -42196,8 +42220,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "RWEP 85. KEV (+25) + PoC/in-wild tradecraft (+20) + confirmed exploitation (+20) + blast_radius 30 (every internet-facing Connect Secure appliance; nation-state initial access plus later ransomware use) - patch_available (-15) + reboot_required (+5). Live-patch credit unavailable (appliance firmware). Σ factors === rwep_score.",
-    "epss_score": 0.94129,
-    "epss_date": "2026-05-28",
+    "epss_score": 0.99971,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.94129 (99.92nd percentile) as of 2026-05-28.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-0282",
     "cwe_refs": [
@@ -42239,7 +42263,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-0282 (CWE-121/CWE-787, CVSS 9.0) + CISA KEV (added 2025-01-08, ransomware-flagged) + Mandiant/Ivanti analyses. The January 2025 Connect Secure zero-day; complements the existing Ivanti EPMM/EPM entries (this is the Connect Secure VPN product) and the perimeter-appliance class exemplified by CVE-2024-21762.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121), zero-day exploited by a China-nexus cluster with the SPAWN malware ecosystem; patch to 22.7R2.5 and rebuild on any ICT compromise indicator."
+    "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121), zero-day exploited by a China-nexus cluster with the SPAWN malware ecosystem; patch to 22.7R2.5 and rebuild on any ICT compromise indicator.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-22457": {
     "ai_assisted_weaponization": false,
@@ -42303,8 +42328,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "RWEP 83. KEV (+25) + in-wild tradecraft (+20) + confirmed exploitation (+20) + blast_radius 28 (internet-facing Connect Secure fleet; weaponized follow-on to CVE-2025-0282) - patch_available (-15) + reboot_required (+5). Σ factors === rwep_score.",
-    "epss_score": 0.58941,
-    "epss_date": "2026-05-28",
+    "epss_score": 0.9999,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.58941 (98.25th percentile) as of 2026-05-28.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-22457",
     "cwe_refs": [
@@ -42346,7 +42371,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-22457 (CWE-121/CWE-787, CVSS 9.0) + CISA KEV (added 2025-04-04, ransomware-flagged) + Mandiant/Ivanti analyses. Weaponized follow-on to the Connect Secure CVE-2025-0282 zero-day; same perimeter-appliance patch-SLA class.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121) initially mis-triaged as DoS then weaponized; patch to 22.7R2.6 and rebuild on compromise indicators."
+    "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121) initially mis-triaged as DoS then weaponized; patch to 22.7R2.6 and rebuild on compromise indicators.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-31324": {
     "ai_assisted_weaponization": false,
@@ -42405,8 +42431,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "RWEP 78. KEV (+25) + PoC/webshell IOCs (+20) + confirmed mass exploitation (+20) + blast_radius 28 (internet-facing SAP NetWeaver ERP install base; webshell-to-ransomware chain) - patch_available (-15). No reboot. Σ factors === rwep_score.",
-    "epss_score": 0.3151,
-    "epss_date": "2026-05-28",
+    "epss_score": 0.99512,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.31510 (96.87th percentile) as of 2026-05-28.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31324",
     "cwe_refs": [
@@ -42450,7 +42476,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-31324 (CWE-434, CVSS 10.0) + CISA KEV (added 2025-04-29, ransomware-flagged) + SAP Security Note 3594142 + ReliaQuest analysis. Complements the existing SAP NetWeaver deserialization entry CVE-2025-42999 with which it was frequently chained in 2025.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "SAP NetWeaver Visual Composer Metadata Uploader missing-authorization file upload (CWE-434) → unauthenticated RCE via JSP webshell; apply SAP Note 3594142 and hunt for webshells."
+    "_kev_short_description": "SAP NetWeaver Visual Composer Metadata Uploader missing-authorization file upload (CWE-434) → unauthenticated RCE via JSP webshell; apply SAP Note 3594142 and hunt for webshells.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-31161": {
     "ai_assisted_weaponization": false,
@@ -42511,8 +42538,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "RWEP 76. KEV (+25) + public exploitation details (+20) + confirmed exploitation, ransomware-flagged (+20) + blast_radius 26 (internet-facing MFT servers; admin takeover, data-extortion class) - patch_available (-15). No reboot. Σ factors === rwep_score.",
-    "epss_score": 0.88937,
-    "epss_date": "2026-05-28",
+    "epss_score": 0.99947,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.88937 (99.54th percentile) as of 2026-05-28.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31161",
     "cwe_refs": [
@@ -42553,7 +42580,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-31161 (CWE-305, CVSS 9.8) + CISA KEV (added 2025-04-07, ransomware-flagged) + Outpost24/VulnCheck/Rapid7 analyses. Distinct from the existing CrushFTP entry CVE-2025-54309 (alternate-channel); CVE-2025-31161 is the March-April 2025 authorization-header auth bypass (duplicate id CVE-2025-2825 noted).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "CrushFTP HTTP authorization-header authentication bypass (CWE-305) → crushadmin takeover; upgrade to 10.8.4/11.3.1 or front with a DMZ proxy."
+    "_kev_short_description": "CrushFTP HTTP authorization-header authentication bypass (CWE-305) → crushadmin takeover; upgrade to 10.8.4/11.3.1 or front with a DMZ proxy.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-30066": {
     "name": "tj-actions/changed-files GitHub Action Supply-Chain Compromise (secret exfiltration to workflow logs)",
@@ -42618,8 +42646,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "Critical (RWEP 78). KEV-listed (25) + confirmed in-the-wild exploitation (20) + the live malicious artifact as PoC (20) + very large blast radius (28; ~23,000 dependent repositories, secrets exfiltrated), minus patch_available (15). Σ factors === rwep_score.",
-    "epss_score": 0.9183,
-    "epss_date": "2026-05-27",
+    "epss_score": 0.72391,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.9183 (99.70th percentile) as of 2026-05-27.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-30066",
     "iocs": {
@@ -42662,7 +42690,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-30066 (CWE-506, CVSS 8.6) + CISA KEV (added 2025-03-18) + StepSecurity/Wiz/Semgrep/Sysdig public analyses. The March 2025 GitHub Actions supply-chain compromise; chained from the reviewdog/action-setup compromise (CVE-2025-30154), which is believed to have leaked the PAT used to repoint the changed-files tags.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "tj-actions/changed-files GitHub Action tags were repointed to malicious code (CWE-506) that dumped CI/CD secrets to publicly readable workflow logs; remediate by pinning actions to commit SHAs and rotating exposed secrets."
+    "_kev_short_description": "tj-actions/changed-files GitHub Action tags were repointed to malicious code (CWE-506) that dumped CI/CD secrets to publicly readable workflow logs; remediate by pinning actions to commit SHAs and rotating exposed secrets.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-30154": {
     "name": "reviewdog/action-setup GitHub Action Supply-Chain Compromise (secret exfiltration to workflow logs)",
@@ -42732,8 +42761,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "Critical (RWEP 72). KEV-listed (25) + confirmed exploitation (20) + live malicious artifact as PoC (20) + broad transitive blast radius (22; five downstream actions, defeated consumer SHA pinning), minus patch_available (15). Σ factors === rwep_score.",
-    "epss_score": 0.34556,
-    "epss_date": "2026-05-27",
+    "epss_score": 0.02296,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.34556 (97.07th percentile) as of 2026-05-27.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-30154",
     "iocs": {
@@ -42771,7 +42800,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-30154 (CWE-506, CVSS 8.6) + CISA KEV (added 2025-03-24) + reviewdog GHSA-qmg3-hpqr-gqvc + Wiz analysis. The reviewdog/action-setup compromise of 2025-03-11; assessed as the upstream pivot of the tj-actions/changed-files compromise (CVE-2025-30066). Shares the CI/CD supply-chain control surface with that entry and the xz-utils backdoor (CVE-2024-3094).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "reviewdog/action-setup@v1 (and five reviewdog actions that include it transitively) was trojaned (CWE-506) to dump secrets to workflow logs; pin actions to commit SHAs and rotate exposed secrets."
+    "_kev_short_description": "reviewdog/action-setup@v1 (and five reviewdog actions that include it transitively) was trojaned (CWE-506) to dump secrets to workflow logs; pin actions to commit SHAs and rotate exposed secrets.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-48027": {
     "name": "Nx Console IDE Extension Supply-Chain Compromise (malicious marketplace version)",
@@ -42949,8 +42979,8 @@
     },
     "rwep_notes": "RWEP recomputed in v0.12.6 after CVSS 9.6→7.8 correction. AV:L (local) reduces blast_radius weight; vendor patch + auto-updating IDE reduce live_patch_available impact.",
     "epss_score": 0.046,
-    "epss_percentile": 0.893,
-    "epss_date": "2026-05-13",
+    "epss_percentile": 0.83649,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-53773",
     "source_verified": "2026-05-13",
     "verification_sources": [
@@ -43000,7 +43030,8 @@
       "forensic_note": "The .vscode/settings.json modification is silent and persistent — no in-editor diff is shown to the user. Defenders investigating suspected compromise should snapshot workspace + user-global settings.json BEFORE remediating; the file IS the primary forensic artifact."
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Disclosed by Johann Rehberger (Embrace the Red, August 2025); responsible disclosure to Microsoft on 2025-06-29. Human researcher per Embrace the Red blog https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/. No AI tool credited for the discovery itself; the attack target IS an AI tool (Copilot)."
+    "discovery_attribution_note": "Disclosed by Johann Rehberger (Embrace the Red, August 2025); responsible disclosure to Microsoft on 2025-06-29. Human researcher per Embrace the Red blog https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/. No AI tool credited for the discovery itself; the attack target IS an AI tool (Copilot).",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-30615": {
     "name": "Windsurf MCP Local-Vector RCE via Adversarial Tool Response",
@@ -43063,9 +43094,9 @@
       "live_patch_available": -10,
       "reboot_required": 0
     },
-    "epss_score": 0.14,
-    "epss_percentile": 0.86,
-    "epss_date": "2026-05-11",
+    "epss_score": 0.00281,
+    "epss_percentile": 0.20294,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-30615",
     "source_verified": "2026-05-01",
     "verification_sources": [
@@ -43121,7 +43152,8 @@
     "cwe_refs": [
       "CWE-94",
       "CWE-1357"
-    ]
+    ],
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -43180,9 +43212,9 @@
       "live_patch_available": -10,
       "reboot_required": 5
     },
-    "epss_score": 0.0257,
-    "epss_percentile": 0.8569,
-    "epss_date": "2026-05-13",
+    "epss_score": 0.99907,
+    "epss_percentile": 0.99967,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-31431",
     "epss_correction_note": "v0.12.9: refreshed from live FIRST API. Catalog previously stored 0.94 / 0.99 (estimate for newly-published CVE; EPSS model cold-start). Live values reflect post-disclosure exploitation telemetry through 2026-05-13.",
     "cwe_refs": [
@@ -43269,7 +43301,8 @@
       "forensic_note": "Copy Fail is deterministic, 732-byte, single-stage, memory-only. Disk-forensic indicators (shell history, dropped binaries, persistence files) are unreliable — competent operators leave no on-disk trace. The runtime_syscall + kernel_trace + behavioral entries are the load-bearing detection surface. Disk indicators are limited to the exploit OUTCOMES (/etc/passwd mutation, suid drift), not the exploit ARTIFACTS."
     },
     "last_updated": "2026-05-13",
-    "discovery_attribution_note": "AI-surfaced by Theori using Xint Code AI scanner with one operator prompt against the Linux crypto/ subsystem; researcher Taeyang Lee directed the scan. Disclosed 2026-04-29. Source: Theori writeup mirrored at https://xint.io/blog/copy-fail-linux-distributions and Sysdig coverage https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds."
+    "discovery_attribution_note": "AI-surfaced by Theori using Xint Code AI scanner with one operator prompt against the Linux crypto/ subsystem; researcher Taeyang Lee directed the scan. Disclosed 2026-04-29. Source: Theori writeup mirrored at https://xint.io/blog/copy-fail-linux-distributions and Sysdig coverage https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-39884": {
     "name": "Flux159 mcp-server-kubernetes Argument Injection via port_forward",
@@ -43330,8 +43363,8 @@
     },
     "rwep_notes": "P3 — patch available, mitigation via tool disable, but the class (AI-mediated argument injection into infrastructure tools) is operationally important to track.",
     "epss_score": 0.00039,
-    "epss_percentile": 0.11727,
-    "epss_date": "2026-05-13",
+    "epss_percentile": 0.1734,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-39884",
     "cwe_refs": [
       "CWE-88"
@@ -43367,7 +43400,8 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "GitHub Security Advisory GHSA-4xqg-gf5c-ghwq published 2026-04-14 by the Flux159/mcp-server-kubernetes maintainers. No researcher byline in the advisory and no AI-tool credit. Bug class is conventional argv-injection via .split(\" \"); the AI-relevant surface is the exploitation channel (prompt-injection-mediated tool call), not the discovery method. Source: https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-4xqg-gf5c-ghwq."
+    "discovery_attribution_note": "GitHub Security Advisory GHSA-4xqg-gf5c-ghwq published 2026-04-14 by the Flux159/mcp-server-kubernetes maintainers. No researcher byline in the advisory and no AI-tool credit. Bug class is conventional argv-injection via .split(\" \"); the AI-relevant surface is the exploitation channel (prompt-injection-mediated tool call), not the discovery method. Source: https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-4xqg-gf5c-ghwq.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-42208": {
     "name": "BerriAI LiteLLM Proxy Auth SQL Injection",
@@ -43430,9 +43464,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Operationally P1 — KEV-listed, network-vector, no auth, full credential DB compromise. AI-stack fleets running LiteLLM as the gateway should patch within the KEV 21-day window at minimum.",
-    "epss_score": 0.37368,
+    "epss_score": 0.8942,
     "epss_percentile": 0.9722,
-    "epss_date": "2026-05-13",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-42208",
     "cwe_refs": [
       "CWE-89"
@@ -43479,7 +43513,8 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Tencent YunDing Security Lab is the credited discoverer per the LiteLLM GHSA-r75f-5x8p-qvmc advisory and confirmed by downstream The Hacker News / Tenable / cve.news coverage. Sysdig TRT (Stefano Chierici + Sysdig Sage analysts) published the post-disclosure 36-hour-to-exploitation telemetry; Bishop Fox reproduced the auth-path SQLi sink. All named-human research; no AI-discovery attribution from any of the three teams. Sources: https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc and https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure and https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy."
+    "discovery_attribution_note": "Tencent YunDing Security Lab is the credited discoverer per the LiteLLM GHSA-r75f-5x8p-qvmc advisory and confirmed by downstream The Hacker News / Tenable / cve.news coverage. Sysdig TRT (Stefano Chierici + Sysdig Sage analysts) published the post-disclosure 36-hour-to-exploitation telemetry; Bishop Fox reproduced the auth-path SQLi sink. All named-human research; no AI-discovery attribution from any of the three teams. Sources: https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc and https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure and https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-43284": {
     "name": "Dirty Frag (ESP/IPsec component)",
@@ -43536,9 +43571,9 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.00007,
-    "epss_percentile": 0.0051,
-    "epss_date": "2026-05-13",
+    "epss_score": 0.93235,
+    "epss_percentile": 0.99826,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-43284",
     "epss_correction_note": "v0.12.9: refreshed from live FIRST API. Previous values (0.18 / 0.88) were estimates for the newly-published CVE; cold-start EPSS routinely overstates newly-cataloged kernel CVEs.",
     "cwe_refs": [
@@ -43636,7 +43671,8 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "rwep_correction_note": "RWEP bump:v0.12.29 ai-discovery audit re-attributed to ai_discovered=true; ai_factor advanced from 0 to 15; rwep raised by 15 from 38 to 53."
+    "rwep_correction_note": "RWEP bump:v0.12.29 ai-discovery audit re-attributed to ai_discovered=true; ai_factor advanced from 0 to 15; rwep raised by 15 from 38 to 53.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-43500": {
     "name": "Dirty Frag (RxRPC component)",
@@ -43686,9 +43722,9 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.0001,
-    "epss_percentile": 0.0115,
-    "epss_date": "2026-05-13",
+    "epss_score": 0.92855,
+    "epss_percentile": 0.9982,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-43500",
     "epss_correction_note": "v0.12.9: refreshed from live FIRST API (cold-start cleanup).",
     "cwe_refs": [
@@ -43793,15 +43829,16 @@
     },
     "pairing_note": "CVE-2026-43500 only realizes its full primitive when chained with CVE-2026-43284. Detection of either subsystem being exercised on a host that should have neither is itself the chain-detection signal. Simultaneous match of esp-module-loaded-no-policy AND rxrpc-active-call-no-afs-config should escalate to a deterministic paired finding.",
     "last_updated": "2026-05-15",
-    "rwep_correction_note": "RWEP bump:v0.12.29 ai-discovery audit re-attributed to ai_discovered=true; ai_factor advanced from 0 to 15; rwep raised by 15 from 32 to 47."
+    "rwep_correction_note": "RWEP bump:v0.12.29 ai-discovery audit re-attributed to ai_discovered=true; ai_factor advanced from 0 to 15; rwep raised by 15 from 32 to 47.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-45321": {
     "name": "Mini Shai-Hulud TanStack npm worm",
     "type": "supply-chain-worm",
     "cvss_score": 9.6,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
-    "cisa_kev": false,
-    "cisa_kev_date": null,
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-05-27",
     "cisa_kev_pending": true,
     "cisa_kev_pending_reason": "Attack disclosed 2026-05-11. Active in-the-wild exploitation of 42 @tanstack/* packages with combined ~150M weekly downloads. CISA KEV listing expected within standard review window.",
     "kev_scope_note": "CISA KEV historically excludes ecosystem-package compromises (npm/PyPI worms, malicious-package backdoors) — its scope is federally-deployable products with CVE assignments. The Mini Shai-Hulud parent (CVE-2026-45321) and TanStack variant are NOT listed in KEV as of 2026-05-15 despite confirmed in-the-wild exploitation. `cisa_kev: false` is correct; `active_exploitation: confirmed` reflects the actual wormable state. Operators should consume CISA-KEV-style guidance from OpenSSF MAL feed + ecosystem-specific advisories (Snyk/Wiz/Phylum/Socket) for this class.",
@@ -43850,9 +43887,9 @@
       "T1574",
       "T1059.007"
     ],
-    "rwep_score": 45,
+    "rwep_score": 70,
     "rwep_factors": {
-      "cisa_kev": 0,
+      "cisa_kev": 25,
       "poc_available": 20,
       "ai_factor": 0,
       "active_exploitation": 20,
@@ -43861,13 +43898,13 @@
       "live_patch_available": -10,
       "reboot_required": 0
     },
-    "rwep_notes": "RWEP cap of 30 on blast_radius understates the real exposure (42 packages, ~150M+ weekly downloads combined). Operationally treat as P0; the formula caps blast_radius regardless of magnitude. Once CISA KEV-lists this CVE, the +25 boost will lift score to 70 (P1 territory).",
+    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +30, patch_available -15, live_patch_available -10. Σ factors === rwep_score.",
     "epss_score": 0.00039,
-    "epss_percentile": 0.1179,
-    "epss_date": "2026-05-13",
+    "epss_percentile": 0.8201,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-45321",
     "epss_correction_note": "v0.12.9: refreshed from live FIRST API. Previous values (0.78 / 0.97) were cold-start estimates inconsistent with confirmed in-wild exploitation; the qualitative narrative (rwep_notes above) remains the authoritative risk signal — raw EPSS underreports newly-disclosed worm payload classes.",
-    "source_verified": "2026-05-13",
+    "source_verified": "2026-08-08",
     "verification_sources": [
       "https://nvd.nist.gov/vuln/detail/CVE-2026-45321",
       "https://github.com/advisories?query=CVE-2026-45321",
@@ -43963,12 +44000,15 @@
         "Windows variant (original Shai-Hulud carry-forward): del /F /Q /S \"%USERPROFILE%*\" && cipher /W:%USERPROFILE%"
       ]
     },
-    "last_updated": "2026-05-15",
+    "last_updated": "2026-08-08",
     "discovery_attribution_note": "Discovery by ecosystem detection (multiple firms — Snyk, Wiz, StepSecurity, Socket, Orca, JFrog) within 20 minutes of TeamPCP's 2026-05-11 publish window of 84 malicious versions across 42 @tanstack/* packages. The worm IS the disclosure event; no AI-discovery tool involved on the defender side. Threat-actor side is engineering-grade chained tradecraft (pull_request_target co-residency, OIDC-token scraping). Source: https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem.",
     "cwe_refs": [
       "CWE-1357",
       "CWE-506"
-    ]
+    ],
+    "cisa_kev_due_date": "2026-06-10",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-08"
   },
   "MAL-2026-3083": {
     "name": "Elementary-Data PyPI Worm (Forged Release via GitHub Actions Script Injection)",
@@ -44307,12 +44347,11 @@
     "type": "container-escape",
     "cvss_score": 8.6,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
-    "cisa_kev": true,
-    "cisa_kev_date": "2024-04-08",
+    "cisa_kev": false,
     "poc_available": true,
     "poc_description": "Snyk Labs published PoC demonstrating container escape via leaked /proc/self/fd file descriptor pointing at host filesystem root.",
     "ai_discovered": false,
-    "active_exploitation": "confirmed",
+    "active_exploitation": "none",
     "affected": "runc <= 1.1.11 — Docker, containerd, Kubernetes, podman, and every container runtime built on runc.",
     "affected_versions": [
       "runc <= 1.1.11"
@@ -44340,30 +44379,29 @@
     "attack_refs": [
       "T1611"
     ],
-    "rwep_score": 80,
+    "rwep_score": 35,
     "rwep_factors": {
-      "cisa_kev": 25,
+      "cisa_kev": 0,
       "poc_available": 20,
       "ai_factor": 0,
-      "active_exploitation": 20,
+      "active_exploitation": 0,
       "blast_radius": 30,
       "patch_available": -15,
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.65,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.18087,
+    "epss_date": "2026-08-07",
     "cwe_refs": [
       "CWE-269",
       "CWE-668"
     ],
-    "source_verified": "2026-05-14",
+    "source_verified": "2026-08-08",
     "verification_sources": [
       "https://nvd.nist.gov/vuln/detail/CVE-2024-21626",
-      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
       "https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/"
     ],
-    "last_updated": "2026-05-15",
+    "last_updated": "2026-08-08",
     "discovery_attribution_note": "Discovered by Rory McNamara of Snyk Security Labs as part of the four-vulnerability Leaky Vessels disclosure (CVE-2024-21626 + CVE-2024-23651/23652/23653) published January 2024. Named human researcher; no AI-tool credited. Source: https://labs.snyk.io/resources/leaky-vessels-docker-runc-container-breakout-vulnerabilities/.",
     "rwep_correction_note": "v0.12.30: canonicalized rwep_factors AND rwep_score to satisfy Shape B invariant. The prior stored rwep_score was internally inconsistent with its rwep_factors block; both now derived from canonical RWEP_WEIGHTS + operational fields. Delta from prior stored: +5 (75 -> 80).",
     "vendor_advisories": [
@@ -44380,13 +44418,6 @@
         "url": "https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/",
         "severity": "high",
         "published_date": "2024-01-31"
-      },
-      {
-        "vendor": "CISA KEV",
-        "advisory_id": "CVE-2024-21626",
-        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
-        "severity": "high",
-        "published_date": "2024-04-08"
       }
     ],
     "iocs": {
@@ -44396,7 +44427,11 @@
         "Files written by a container to host directories that are not part of any declared mount."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2024-21626, CISA KEV, and the Snyk 'Leaky Vessels' analysis."
-    }
+    },
+    "known_ransomware_use": false,
+    "active_exploitation_notes": "No in-the-wild exploitation reported. The vulnerability was found by Snyk Labs research and disclosed 2024-01-31 with a proof-of-concept demonstrating the escape; the public exploit code is that disclosure PoC, not a captured intrusion artifact. CISA has never listed it in the Known Exploited Vulnerabilities catalog, and KEV's listing criterion is reliable evidence of active exploitation.",
+    "rwep_notes": "RWEP 35. poc_available +20, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2024-3094": {
     "ai_assisted_weaponization": false,
@@ -44404,8 +44439,7 @@
     "type": "supply-chain-backdoor",
     "cvss_score": 10,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
-    "cisa_kev": true,
-    "cisa_kev_date": "2024-04-03",
+    "cisa_kev": false,
     "poc_available": true,
     "poc_description": "Backdoor itself is the PoC — public analyses by Andres Freund, Akamai, JFrog, Binarly document the signed-binary insertion and the sshd RSA-pubkey-mediated payload trigger.",
     "ai_discovered": false,
@@ -44444,9 +44478,9 @@
       "T1195.002",
       "T1554"
     ],
-    "rwep_score": 70,
+    "rwep_score": 45,
     "rwep_factors": {
-      "cisa_kev": 25,
+      "cisa_kev": 0,
       "poc_available": 20,
       "ai_factor": 0,
       "active_exploitation": 10,
@@ -44461,13 +44495,13 @@
       "CWE-506",
       "CWE-1357"
     ],
-    "source_verified": "2026-05-14",
+    "source_verified": "2026-08-08",
     "verification_sources": [
       "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
       "https://www.openwall.com/lists/oss-security/2024/03/29/4",
       "https://research.swtch.com/xz-script"
     ],
-    "last_updated": "2026-05-15",
+    "last_updated": "2026-08-08",
     "discovery_attribution_note": "Discovered by Andres Freund (Microsoft engineer, PostgreSQL developer) on 2024-03-28 via a 0.5-second SSH-login latency regression traced to liblzma symbol resolution; reported to oss-security. Named human researcher; no AI tooling involved. Source: https://en.wikipedia.org/wiki/XZ_Utils_backdoor.",
     "rwep_correction_note": "v0.12.30: canonicalized rwep_factors to satisfy Shape B invariant (Σ factors === rwep_score). Prior values used non-canonical weights and/or blast_radius > 30 (over-cap). Stored rwep_score unchanged; factor block now reproducible from canonical RWEP_WEIGHTS + operational fields.",
     "vendor_advisories": [
@@ -44484,13 +44518,6 @@
         "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
         "severity": "critical",
         "published_date": "2024-03-29"
-      },
-      {
-        "vendor": "CISA KEV",
-        "advisory_id": "CVE-2024-3094",
-        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
-        "severity": "critical",
-        "published_date": "2024-04-03"
       }
     ],
     "iocs": {
@@ -44500,7 +44527,10 @@
         "sshd routing specific attacker-supplied RSA public keys to a non-standard code path (the Ed448-gated backdoor trigger)."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2024-3094, the openwall oss-security disclosure, and research.swtch.com/xz-script."
-    }
+    },
+    "known_ransomware_use": false,
+    "rwep_notes": "RWEP 45. poc_available +20, active_exploitation +10, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2024-3154": {
     "ai_assisted_weaponization": false,
@@ -44629,8 +44659,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.014,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.36582,
+    "epss_date": "2026-08-07",
     "cwe_refs": [
       "CWE-22"
     ],
@@ -44649,7 +44679,8 @@
         "Encoded/stacked traversal tokens (%2e%2e%2f, ....//) targeting MLflow artifact endpoints."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2023-43472 and the Protect AI Huntr report cited in verification_sources."
-    }
+    },
+    "last_verified": "2026-08-08"
   },
   "CVE-2020-10148": {
     "ai_assisted_weaponization": false,
@@ -44975,8 +45006,8 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.5,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.90272,
+    "epss_date": "2026-08-07",
     "cwe_refs": [
       "CWE-287"
     ],
@@ -45018,7 +45049,8 @@
         "An internet-facing Cisco SD-WAN management interface running a release below the fixed version."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2026-20182, CISA KEV, and the Cisco security advisory."
-    }
+    },
+    "last_verified": "2026-08-08"
   },
   "CVE-2024-40635": {
     "ai_assisted_weaponization": false,
@@ -47033,8 +47065,8 @@
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
     "cisa_kev": true,
-    "cisa_kev_date": "2025-12-15",
-    "cisa_kev_due_date": "2026-01-05",
+    "cisa_kev_date": "2025-12-12",
+    "cisa_kev_due_date": "2026-01-02",
     "poc_available": false,
     "poc_description": "No public PoC; exploit observed in targeted attacks against specific individuals consistent with commercial-spyware / nation-state operator tradecraft. Apple characterized the activity as 'extremely sophisticated'.",
     "ai_discovered": false,
@@ -47083,8 +47115,8 @@
       "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
       "https://nvd.nist.gov/vuln/detail/CVE-2025-14174"
     ],
-    "source_verified": "2026-05-18",
-    "last_updated": "2026-05-18",
+    "source_verified": "2026-08-08",
+    "last_updated": "2026-08-08",
     "vendor_advisories": [
       {
         "vendor": "Apple",
@@ -47107,7 +47139,10 @@
         "Indicators of targeted-spyware staging following web content rendering on a high-risk-user device (Lockdown Mode relevant)."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-14174 and the Apple security update notes for the targeted-exploitation fix."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-08",
+    "rwep_notes": "RWEP 55. cisa_kev +25, active_exploitation +20, blast_radius +20, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2025-43529": {
     "id": "CVE-2025-43529",
@@ -47272,8 +47307,8 @@
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
     "cisa_kev": true,
-    "cisa_kev_date": "2025-03-12",
-    "cisa_kev_due_date": "2025-04-02",
+    "cisa_kev_date": "2025-03-13",
+    "cisa_kev_due_date": "2025-04-03",
     "poc_available": true,
     "poc_description": "Public 'Glass Cage' zero-click iMessage PNG chain on GitHub combines CVE-2025-43300 (ImageIO) + CVE-2025-24201 (WebKit OOB write) + CVE-2025-24085 (Core Media) for sandbox escape + kernel-level access + device bricking on iOS 18.2.1. Targeted exploitation observed by Apple prior to disclosure.",
     "ai_discovered": false,
@@ -47322,8 +47357,8 @@
       "https://support.apple.com/en-us/122281",
       "https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201"
     ],
-    "source_verified": "2026-05-18",
-    "last_updated": "2026-05-18",
+    "source_verified": "2026-08-08",
+    "last_updated": "2026-08-08",
     "vendor_advisories": [
       {
         "vendor": "Apple",
@@ -47345,7 +47380,10 @@
         "Targeted delivery of malicious web content as part of a multi-stage exploit chain."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-24201 and the Apple security update notes (supplementary fix for a previously-mitigated attack)."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-08",
+    "rwep_notes": "RWEP 80. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +25, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2025-43300": {
     "id": "CVE-2025-43300",
@@ -47674,9 +47712,7 @@
     "type": "sql-injection-rce",
     "cvss_score": 8.1,
     "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
-    "cisa_kev": true,
-    "cisa_kev_date": "2025-02-13",
-    "cisa_kev_due_date": "2025-03-06",
+    "cisa_kev": false,
     "poc_available": true,
     "poc_description": "Public Rapid7 advisory + Metasploit module + ishwardeepp PoC on GitHub. Invalid-UTF-8 byte sequences interact with PostgreSQL string-escaping routines and psql meta-command processing to permit injection and arbitrary command execution. Exploited in BeyondTrust + US Treasury breaches.",
     "ai_discovered": false,
@@ -47710,7 +47746,7 @@
       "T1059"
     ],
     "rwep_factors": {
-      "cisa_kev": 25,
+      "cisa_kev": 0,
       "poc_available": 20,
       "ai_factor": 0,
       "active_exploitation": 20,
@@ -47719,15 +47755,14 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "rwep_score": 77,
+    "rwep_score": 52,
     "verification_sources": [
       "https://nvd.nist.gov/vuln/detail/CVE-2025-1094",
-      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
       "https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-psql-sql-injection-fixed/",
       "https://www.postgresql.org/support/security/"
     ],
-    "source_verified": "2026-05-18",
-    "last_updated": "2026-05-18",
+    "source_verified": "2026-08-08",
+    "last_updated": "2026-08-08",
     "vendor_advisories": [
       {
         "vendor": "PostgreSQL Global Development Group",
@@ -47749,7 +47784,11 @@
         "PostgreSQL/psql client below the patched version in a chain following an application-layer injection (the BeyondTrust RS exploitation pattern)."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-1094 and the PostgreSQL project security advisory."
-    }
+    },
+    "known_ransomware_use": false,
+    "active_exploitation_notes": "Exploitation documented by Rapid7 in the BeyondTrust Remote Support intrusions, chained with CVE-2024-12356 and CVE-2024-12686 — both of which ARE CISA KEV-listed (added 2024-12-19 and 2025-01-13). This CVE itself is not KEV-listed; the federal-directive weight belongs to its chain partners.",
+    "rwep_notes": "RWEP 52. poc_available +20, active_exploitation +20, blast_radius +27, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-49844": {
     "id": "CVE-2025-49844",
@@ -47838,8 +47877,8 @@
     "type": "information-disclosure-heap",
     "cvss_score": 7.5,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
-    "cisa_kev": false,
-    "cisa_kev_date": null,
+    "cisa_kev": true,
+    "cisa_kev_date": "2025-12-29",
     "poc_available": true,
     "poc_description": "Public exploit code observed; active opportunistic scanning of internet-exposed MongoDB instances reported. Mismatched length fields in zlib-compressed wire-protocol headers cause MongoDB Server to return uninitialized heap memory to unauthenticated clients.",
     "ai_discovered": false,
@@ -47870,7 +47909,7 @@
       "T1005"
     ],
     "rwep_factors": {
-      "cisa_kev": 0,
+      "cisa_kev": 25,
       "poc_available": 20,
       "ai_factor": 0,
       "active_exploitation": 20,
@@ -47879,14 +47918,14 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "rwep_score": 47,
+    "rwep_score": 72,
     "verification_sources": [
       "https://nvd.nist.gov/vuln/detail/CVE-2025-14847",
       "https://www.mongodb.com/alerts",
       "https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2025-14847-mongodb-mongobleed"
     ],
-    "source_verified": "2026-05-18",
-    "last_updated": "2026-05-18",
+    "source_verified": "2026-08-08",
+    "last_updated": "2026-08-08",
     "vendor_advisories": [
       {
         "vendor": "MongoDB",
@@ -47909,7 +47948,11 @@
         "Anomalous compressed-message traffic to MongoDB preceding memory-disclosure responses."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-14847 and the Bitsight 'MongoBleed' analysis cited in verification_sources."
-    }
+    },
+    "cisa_kev_due_date": "2026-01-19",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-08",
+    "rwep_notes": "RWEP 72. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15. Σ factors === rwep_score."
   },
   "CVE-2025-8671": {
     "id": "CVE-2025-8671",
@@ -86366,8 +86409,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate (RWEP 19, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 2.9.4 (Hard Rule #3): poc_available=20 + blast_radius=14 (authenticated arbitrary file read in a widely used LLM app framework - host secrets/config readable), minus patch_available 15.",
-    "epss_score": 0.00044,
-    "epss_date": "2026-05-26",
+    "epss_score": 0.08845,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.00044 (14th percentile) as of 2026-05-26.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-22218",
     "cwe_refs": [
@@ -86406,7 +86449,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-22218 (CWE-22) + VulnCheck (CNA, CVSS v4.0 7.1). Chainlit LLM-app-framework arbitrary file read; reuses the AI-runtime-API path-traversal validation control NEW-CTRL-094 (shared with the AnythingLLM upload path-traversal and the Ollama path-traversal class).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Chainlit /project/element copies a caller-supplied file path into the user's session without validation, letting an authenticated client read arbitrary host files (CWE-22); fixed in 2.9.4."
+    "_kev_short_description": "Chainlit /project/element copies a caller-supplied file path into the user's session without validation, letting an authenticated client read arbitrary host files (CWE-22); fixed in 2.9.4.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-22219": {
     "name": "Chainlit /project/element SQLAlchemy-Backend Server-Side Request Forgery",
@@ -87001,8 +87045,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "High (RWEP 31, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 1.121.0 (Hard Rule #3): poc_available=20 + blast_radius=26 (unauthenticated CVSS-10.0 arbitrary file read that the public exploit chains into admin-session forgery + Execute Command host RCE on locally deployed instances; >100k internet-reachable instances; elevated EPSS), minus patch_available 15.",
-    "epss_score": 0.06939,
-    "epss_date": "2026-05-26",
+    "epss_score": 0.71647,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.06939 (91st percentile) as of 2026-05-26.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-21858",
     "cwe_refs": [
@@ -87042,7 +87086,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-21858 (CWE-20) + the n8n GitHub Security Advisory (CNA, CVSS v3.1 10.0). n8n workflow-automation unauthenticated file access via form actions; reuses the AI-runtime-API path-traversal validation control NEW-CTRL-094.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "n8n 1.65.0-1.120.x lets an unauthenticated attacker access server files via form-based actions without path confinement (CWE-20); fixed in 1.121.0."
+    "_kev_short_description": "n8n 1.65.0-1.120.x lets an unauthenticated attacker access server files via form-based actions without path confinement (CWE-20); fixed in 1.121.0.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-68668": {
     "name": "n8n Python Code Node Pyodide Sandbox Bypass RCE",
@@ -87105,8 +87150,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate-high (RWEP 27, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 2.0.0 (Hard Rule #3): poc_available=20 + blast_radius=22 (authenticated code-node sandbox escape to host RCE in a widely deployed workflow builder), minus patch_available 15.",
-    "epss_score": 0.00035,
-    "epss_date": "2026-05-26",
+    "epss_score": 0.12901,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.00035 (10th percentile) as of 2026-05-26.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-68668",
     "cwe_refs": [
@@ -87144,7 +87189,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-68668 (CWE-693) + the n8n GitHub Security Advisory (CNA, CVSS v3.1 9.9). n8n Python Code Node Pyodide sandbox bypass; reuses the AI-app-builder execution-endpoint auth-and-sandbox control NEW-CTRL-103 (shared with the Dify code-node escape and Langflow/Flowise RCEs).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "n8n's Python Code Node Pyodide sandbox is bypassable, so an authenticated workflow editor runs code with host privileges (CWE-693); fixed in 2.0.0."
+    "_kev_short_description": "n8n's Python Code Node Pyodide sandbox is bypassable, so an authenticated workflow editor runs code with host privileges (CWE-693); fixed in 2.0.0.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2024-31462": {
     "name": "stable-diffusion-webui Backup/Restore Limited File Write (Path Traversal)",
@@ -87512,8 +87558,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "High (RWEP 29, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 1.121.3 (Hard Rule #3): poc_available=20 + blast_radius=24 (authenticated file-write-to-RCE with full compromise across self-hosted + Cloud, elevated EPSS), minus patch_available 15.",
-    "epss_score": 0.10735,
-    "epss_date": "2026-05-26",
+    "epss_score": 0.05258,
+    "epss_date": "2026-08-07",
     "epss_note": "FIRST EPSS 0.10735 (93rd percentile) as of 2026-05-26.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-21877",
     "cwe_refs": [
@@ -87553,7 +87599,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-21877 (CWE-434 / CWE-94) + GitHub Security Advisory GHSA-v364-rw7m-3263 (CNA, CVSS v3.1 9.9). n8n Git-node arbitrary-file-write-to-RCE; reuses the AI-app-builder execution-endpoint auth-and-sandbox control NEW-CTRL-103 (shared with the n8n code-node escape, Dify code-node, and Langflow/Flowise RCEs).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "n8n's Git node lets an authenticated user write a dangerous file to an arbitrary path for RCE and full instance compromise (CWE-434/CWE-94); fixed in 1.121.3."
+    "_kev_short_description": "n8n's Git node lets an authenticated user write a dangerous file to an arbitrary path for RCE and full instance compromise (CWE-434/CWE-94); fixed in 1.121.3.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-51764": {
     "ai_assisted_weaponization": false,
@@ -90938,8 +90985,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.02269,
-    "epss_date": "2026-06-26",
+    "epss_score": 0.62767,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34909",
     "cwe_refs": [
@@ -90982,7 +91029,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path traversal (arbitrary file read/write), framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path traversal (arbitrary file read/write), framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-34908": {
     "name": "Ubiquiti UniFi OS Improper Access Control Vulnerability",
@@ -91044,8 +91092,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.0086,
-    "epss_date": "2026-06-26",
+    "epss_score": 0.61906,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34908",
     "cwe_refs": [
@@ -91088,7 +91136,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the access-control bypass, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the access-control bypass, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-20253": {
     "name": "Splunk Enterprise Missing Authentication for Critical Function Vulnerability",
@@ -91258,8 +91307,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.80425,
-    "epss_date": "2026-06-26",
+    "epss_score": 0.55914,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48907",
     "cwe_refs": [
@@ -91302,7 +91351,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. ",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the editor access-control bypass enabling webshell upload, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the editor access-control bypass enabling webshell upload, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-54420": {
     "name": "LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability",
@@ -91471,8 +91521,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.01741,
-    "epss_date": "2026-06-26",
+    "epss_score": 0.28171,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20262",
     "cwe_refs": [
@@ -91515,7 +91565,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the path traversal, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the path traversal, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-34028": {
     "name": "Commvault Command Center Path Traversal Vulnerability",
@@ -91788,8 +91839,8 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.9393,
-    "epss_date": "2026-06-26",
+    "epss_score": 0.99957,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-38475",
     "cwe_refs": [
@@ -91832,7 +91883,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2023-44221": {
     "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
@@ -92318,8 +92370,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.1193,
-    "epss_date": "2026-06-26",
+    "epss_score": 0.58616,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24054",
     "cwe_refs": [
@@ -92362,7 +92414,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the NTLM hash disclosure via crafted .library-ms files, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the NTLM hash disclosure via crafted .library-ms files, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-31201": {
     "name": "Apple Multiple Products Arbitrary Read and Write Vulnerability",
@@ -94566,8 +94619,8 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.163,
-    "epss_date": "2026-06-28",
+    "epss_score": 0.01972,
+    "epss_date": "2026-08-07",
     "epss_note": "EPSS pulled from FIRST.org at curation time.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24984",
     "cwe_refs": [
@@ -94610,7 +94663,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS information disclosure via sensitive data written to a log, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS information disclosure via sensitive data written to a log, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2025-24983": {
     "name": "Microsoft Windows Win32k Use-After-Free Vulnerability",
@@ -94732,9 +94786,9 @@
     "active_exploitation": "confirmed",
     "complexity": "high",
     "vector": "WordPress Core mishandles the author__not_in parameter of WP_Query, allowing SQL injection when untrusted input reaches the parameter; chained with CVE-2026-63030 for unauthenticated remote code execution.",
-    "epss_score": 0.20395,
+    "epss_score": 0.79029,
     "epss_percentile": 0.97219,
-    "epss_date": "2026-07-22",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-60137",
     "vendor_advisories": [
       {
@@ -94813,7 +94867,8 @@
       "reboot_required": 0
     },
     "rwep_score": 78,
-    "rwep_notes": "RWEP 78. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +28, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 78. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +28, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-63030": {
     "name": "WordPress Core Interpretation Conflict Vulnerability",
@@ -94829,9 +94884,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "WordPress Core REST API batch endpoint (/wp-json/batch/v1) has an array-desynchronization interpretation conflict that misroutes handler dispatch, letting an unauthenticated attacker bypass validation to perform SQL injection and achieve remote code execution; chained with CVE-2026-60137.",
-    "epss_score": 0.38599,
+    "epss_score": 0.98417,
     "epss_percentile": 0.98425,
-    "epss_date": "2026-07-22",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-63030",
     "vendor_advisories": [
       {
@@ -94911,7 +94966,8 @@
       "reboot_required": 0
     },
     "rwep_score": 79,
-    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +29, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +29, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-0770": {
     "name": "Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
@@ -95031,9 +95087,9 @@
     "active_exploitation": "confirmed",
     "complexity": "high",
     "vector": "DD-WRT UPnP/SSDP handler (ssdp.c, ssdp_msearch) performs an unbounded strcpy of a user-supplied oversized ST-header value into a fixed 128-byte stack buffer, allowing an unauthenticated attacker to overflow the buffer and achieve code execution.",
-    "epss_score": 0.10809,
+    "epss_score": 0.16488,
     "epss_percentile": 0.95377,
-    "epss_date": "2026-07-22",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-27137",
     "vendor_advisories": [
       {
@@ -95119,7 +95175,8 @@
       "reboot_required": 5
     },
     "rwep_score": 70,
-    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08"
   },
   "CVE-2026-18556": {
     "name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-18556)",
@@ -95136,8 +95193,8 @@
     "complexity": "high",
     "vector": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.",
     "epss_score": 0.0027,
-    "epss_percentile": 0.19053,
-    "epss_date": "2026-08-04",
+    "epss_percentile": 0.39697,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-18556",
     "vendor_advisories": [
       {
@@ -95206,7 +95263,7 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "last_verified": "2026-08-05",
+    "last_verified": "2026-08-08",
     "ai_discovery_source": "vendor_research",
     "iocs": {
       "behavioral": [
@@ -95241,9 +95298,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
-    "epss_score": 0.42627,
+    "epss_score": 0.8116,
     "epss_percentile": 0.9858,
-    "epss_date": "2026-08-04",
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34486",
     "vendor_advisories": [
       {
@@ -95309,7 +95366,7 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "last_verified": "2026-08-05",
+    "last_verified": "2026-08-08",
     "ai_discovery_source": "human_researcher",
     "iocs": {
       "behavioral": [
@@ -95345,9 +95402,9 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments",
-    "epss_score": 0.01886,
-    "epss_percentile": 0.77474,
-    "epss_date": "2026-08-04",
+    "epss_score": 0.17053,
+    "epss_percentile": 0.96777,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-9198",
     "vendor_advisories": [
       {
@@ -95410,7 +95467,7 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "last_verified": "2026-08-05",
+    "last_verified": "2026-08-08",
     "ai_discovery_source": "vendor_research",
     "iocs": {
       "behavioral": [
@@ -95448,8 +95505,8 @@
     "complexity": "high",
     "vector": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
     "epss_score": 0.02529,
-    "epss_percentile": 0.83327,
-    "epss_date": "2026-08-04",
+    "epss_percentile": 0.89781,
+    "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-18577",
     "vendor_advisories": [
       {
@@ -95514,7 +95571,7 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "last_verified": "2026-08-05",
+    "last_verified": "2026-08-08",
     "ai_discovery_source": "vendor_research",
     "iocs": {
       "behavioral": [
@@ -105609,5 +105666,230 @@
     "blast_radius": 28,
     "rwep_notes": "RWEP 83. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +28, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
     "discovery_attribution_note": "Curated from NVD CVE-2022-21971 (CWE-824, CVSS 7.8) + CISA KEV (added 2022-08-18) + Microsoft vendor advisory."
+  },
+  "CVE-2026-63077": {
+    "name": "JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-502"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-08-05",
+    "cisa_kev_due_date": "2026-08-08",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "In JetBrains TeamCity On-Premises before 2025.11.7 and 2026.1.3, the unauthenticated agent-polling protocol deserializes attacker-controlled XML through a permissively-configured XStream 1.4.20.3 allowlist that retained XStream's default type permissions: an unauthenticated attacker registers a synthetic agent at /app/agents/v1/register to obtain a session, posts a crafted gadget chain to /app/agents/v1/commands/error that writes a JSP polyglot into the webroot (../webapps/ROOT/<hex>.jspws) via an in-memory HSQLDB SCRIPT command, then requests the dropped .jspws file to execute arbitrary OS commands with the privileges of the TeamCity server process.",
+    "epss_score": 0.0101,
+    "epss_percentile": 0.59827,
+    "epss_date": "2026-08-07",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-63077",
+    "vendor_advisories": [
+      {
+        "vendor": "JetBrains",
+        "advisory_id": "CVE-2026-63077",
+        "url": "https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/",
+        "severity": "critical",
+        "published_date": "2026-07-27"
+      },
+      {
+        "vendor": "JetBrains",
+        "advisory_id": "CVE-2026-63077-update",
+        "url": "https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/",
+        "severity": "critical",
+        "published_date": "2026-08-07"
+      },
+      {
+        "vendor": "JetBrains",
+        "advisory_id": "issues-fixed",
+        "url": "https://www.jetbrains.com/privacy-security/issues-fixed/",
+        "severity": "critical",
+        "published_date": "2026-07-27"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-63077",
+      "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-63077",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/",
+      "https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/",
+      "https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/",
+      "https://github.com/sfewer-r7/CVE-2026-63077",
+      "https://github.com/BoredHackerBlog/teamcity-CVE-2026-63077-pcap",
+      "https://api.first.org/data/v1/epss?cve=CVE-2026-63077"
+    ],
+    "source_verified": "2026-08-08",
+    "last_updated": "2026-08-08",
+    "_kev_short_description": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.",
+    "type": "deserialization-rce",
+    "poc_available": true,
+    "poc_description": "poc_available: a weaponized public PoC exists. Rapid7's Stephen Fewer published a working Python exploit at github.com/sfewer-r7/CVE-2026-63077 (CVE-2026-63077.py, 446 lines) that registers a synthetic agent at /app/agents/v1/register, posts an XStream 1.4.20.3 gadget-chain payload to /app/agents/v1/commands/error to write a JSP polyglot into ../webapps/ROOT/<hex>.jspws via an in-memory HSQLDB SCRIPT command, then GETs the dropped file to run an arbitrary OS command (default notepad.exe) as the TeamCity server process. Rapid7 published a matching root-cause analysis and BoredHackerBlog published a corroborating exploitation PCAP (github.com/BoredHackerBlog/teamcity-CVE-2026-63077-pcap) captured against TeamCity 2025.11.3. At curation time no Metasploit module (checked rapid7/metasploit-framework) and no Nuclei template (checked projectdiscovery/nuclei-templates) was present, and Exploit-DB had no entry - the public artifact set is the sfewer-r7 exploit script plus the PCAP.",
+    "ai_discovered": false,
+    "ai_discovery_notes": "Reported privately to JetBrains by external researcher Antoni Tremblay on 2026-07-10; JetBrains disclosed and fixed it on 2026-07-27. The public PoC was authored by Rapid7's Stephen Fewer. No AI tooling is credited in the JetBrains advisory, the JetBrains active-exploitation update, the Rapid7 analysis, or the PoC - this is a human-researcher finding.",
+    "ai_assisted_weaponization": false,
+    "affected": "JetBrains TeamCity On-Premises continuous-integration / build server, where the unauthenticated agent-polling protocol unsafely deserializes attacker-controlled XML (XStream 1.4.20.3) and lets a remote attacker execute OS commands as the TeamCity server process.",
+    "affected_versions": [
+      "TeamCity On-Premises < 2025.11.7",
+      "TeamCity On-Premises 2026.1 - 2026.1.2 (< 2026.1.3)",
+      "All TeamCity On-Premises releases prior to the 2025.11.7 / 2026.1.3 fixes (JetBrains security patch plugin available for 2017.1+); TeamCity Cloud not affected - already mitigated by JetBrains"
+    ],
+    "complexity_notes": "AV:N/AC:L/PR:N/UI:N - unauthenticated, network-reachable, no user interaction and no race condition; the XStream gadget chain is deterministic and a single-command public PoC turns it into one-shot RCE. CISA's SSVC decision for this CVE records exploitation=active, automatable=yes, technicalImpact=total (from the NVD ssvcV203 block).",
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No kernel-style live patch. Remediation is upgrading TeamCity On-Premises to 2025.11.7 or 2026.1.3, or installing JetBrains' security patch plugin (available for 2017.1+). The plugin loads without a server restart on 2018.2 and later but requires a restart on 2017.1-2018.1; a full version upgrade requires a server restart (brief CI outage). TeamCity Cloud was already mitigated by JetBrains and needs no customer action. Because exploitation began after disclosure, patched operators should also grep teamcity-server.log for XStream ConversionException/ForbiddenClassException entries, audit build agents named 'scan*', remove any *.jspws files from the webroot, and rotate stored CI/CD credentials as potentially exposed.",
+    "blast_radius": 22,
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation had almost no slack here: JetBrains disclosed and patched on 2026-07-27, reports of active exploitation of the unauthenticated agent-polling RCE followed within days, and CISA set a 3-day KEV deadline (added 2026-08-05, due 2026-08-08). A routine SI-2 patch cadence measured in weeks leaves an internet-facing TeamCity server exploitable for the entire window that a pre-auth, automatable RCE is already being weaponized.",
+      "NIS2-Art21-supply-chain": "NIS2 Art.21 supply-chain-security clauses focus on vetting third-party suppliers, but here the organization's own CI/CD build server is the injection point - unauthenticated RCE as the TeamCity server process lets an attacker steal stored credentials, tamper with build artifacts and inject code into downstream pipelines, a supply-chain compromise originating inside internal build infrastructure that supplier-assurance controls do not cover.",
+      "UK-CAF-B4": "CAF B4 (secure system configuration) assumes untrusted network input never reaches an unsafe deserializer, but TeamCity's XStream 1.4.20.3 allowlist retained default type permissions, so the unauthenticated /app/agents/v1/commands/error endpoint deserialized attacker XML into a working gadget chain - a product design flaw that operator-side B4 hardening (config baselines, firewalling) cannot remediate without the vendor fix.",
+      "AU-Essential-8-Patch": "Essential Eight 'patch applications' mandates patching internet-facing services within 48 hours once an exploit exists, which was technically achievable (the fix shipped 2026-07-27), yet E8 does not require network-isolating an internet-exposed CI server, so any instance left reachable even briefly after disclosure was hit by this automatable pre-auth RCE before the 48-hour clock could close the exposure gap.",
+      "ISO-27001-2022-A.8.8": "A.8.8 technical-vulnerability-management programs that prioritize by CVSS/EPSS would have under-ranked this: EPSS sat at 0.010 (58th percentile) on the KEV date despite confirmed in-the-wild exploitation, so a purely score-driven queue would defer a CVSS 9.8 unauthenticated RCE that CISA had already flagged active - the KEV listing and the vendor's exploitation report, not the probabilistic score, were the true prioritization signal."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1195.002"
+    ],
+    "rwep_score": 72,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_notes": "RWEP 72. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Curated from NVD CVE-2026-63077 (CWE-502, CVSS 9.8) + CISA KEV (added 2026-08-05) + JetBrains TeamCity advisory CVE-2026-63077 (27-Jul-2026), with root-cause analysis and PoC from Rapid7 (Stephen Fewer, github.com/sfewer-r7/CVE-2026-63077). Reported privately to JetBrains by Antoni Tremblay on 2026-07-10.",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated POST to /app/agents/v1/register (synthetic agent with agentAddress=127.0.0.1, agentPort=9090 and a random authToken) that returns a TeamCity-AgentSessionId header, immediately followed by a POST to /app/agents/v1/commands/error carrying an XStream XML gadget-chain payload with that TeamCity-AgentSessionId (and TeamCity-AgentCommandId) header.",
+        "A randomly-named <hex>.jspws file written under the TeamCity webroot (../webapps/ROOT) via an in-memory HSQLDB SCRIPT command, then a GET to /<hex>.jspws that compiles the JSP polyglot and runs java.lang.Runtime.getRuntime().exec() with the attacker's OS command as the TeamCity server process.",
+        "Unauthorized build agents registering with names beginning 'scan' (per the JetBrains active-exploitation update) - attacker-registered synthetic agents left over from the exploit's registration step."
+      ],
+      "indicators": [
+        "teamcity-server.log entries: com.thoughtworks.xstream.converters.ConversionException (attempted or successful exploit) or com.thoughtworks.xstream.security.ForbiddenClassException naming jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage$SchemaMismatchException (a blocked attempt on a patched server), plus freemarker.core._TemplateModelException referencing the 'connection' property and org.hsqldb.HsqlException 'file input/output error' for .jspws paths.",
+        "Unexpected *.jspws files in the TeamCity webapps/ROOT (webroot) directory.",
+        "TeamCity On-Premises below 2025.11.7, or 2026.1-2026.1.2 (< 2026.1.3)."
+      ],
+      "_ioc_source_note": "Extracted from the public Rapid7 PoC by Stephen Fewer (github.com/sfewer-r7/CVE-2026-63077, CVE-2026-63077.py - endpoints /app/agents/v1/register + /app/agents/v1/commands/error, the XStream HSQLMetadataStorage$SchemaMismatchException gadget, and the <hex>.jspws webroot drop) cross-referenced with the Rapid7 root-cause analysis (rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/) and the JetBrains active-exploitation update (blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/ - the ConversionException/ForbiddenClassException log strings and 'scan'-prefixed rogue agents); BoredHackerBlog published a corroborating exploitation PCAP (github.com/BoredHackerBlog/teamcity-CVE-2026-63077-pcap). Anchored to NVD CVE-2026-63077 (CWE-502, CVSS 9.8) + CISA KEV (added 2026-08-05)."
+    },
+    "_intake_method": "batch-curated"
+  },
+  "CVE-2026-8037": {
+    "name": "Progress LoadMaster Command Injection Vulnerability",
+    "cvss_score": 9.6,
+    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-77"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-08-07",
+    "cisa_kev_due_date": "2026-08-10",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "The escape_quotes() helper that prepares user input for a single-quoted shell argument allocates its output buffer with malloc() and never writes a terminating null byte, so the escaped string runs on into whatever the heap chunk held before. An unauthenticated POST to /accessv2 that supplies a quote-bearing apiuser value forces that allocation while dozens of sibling JSON keys spray attacker-chosen bytes across freed chunks of the same size, and the shell argument then reads past its own data into the sprayed payload — turning an uninitialized-memory bug into OS command execution on the appliance.",
+    "epss_score": 0.84793,
+    "epss_percentile": 0.99688,
+    "epss_date": "2026-08-07",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-8037",
+    "vendor_advisories": [
+      {
+        "vendor": "Progress",
+        "advisory_id": null,
+        "url": "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691",
+        "severity": "critical",
+        "published_date": "2026-06-04"
+      },
+      {
+        "vendor": "Zero Day Initiative",
+        "advisory_id": "ZDI-26-342",
+        "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-342/",
+        "severity": "critical",
+        "published_date": "2026-06-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-8037",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691",
+      "https://www.zerodayinitiative.com/advisories/ZDI-26-342/",
+      "https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/",
+      "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037"
+    ],
+    "source_verified": "2026-08-08",
+    "last_updated": "2026-08-08",
+    "_kev_short_description": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.",
+    "type": "uninitialized-heap-command-injection-preauth-rce",
+    "poc_available": true,
+    "poc_description": "A weaponized public exploit exists. ProjectDiscovery ships a Nuclei template at http/cves/2026/CVE-2026-8037.yaml (authors watchtowr and DhiyaneshDk, severity critical, tags cve,cve2026,progress,loadmaster,rce,vkev) that sends a single unauthenticated POST /accessv2 with apiuser set to a run of single quotes to force the malloc path, sixty-one sibling keys g0..g60 each carrying \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\" to spray the heap, and matches on root:x:0:0: in a text/json 200 response. Two public repositories also carry exploit code — github.com/Caster-chen/CVE-2026-8037-POC (command-execution probe plus a one-click getshell) and github.com/HORKimhab/CVE-2026-8037. watchTowr Labs published the root-cause analysis by Sina Kheirkhah at labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/, including the binary diff of escape_quotes() between 7.2.63.1 and 7.2.63.2. No Exploit-DB entry and no Metasploit module existed at curation time (checked files_exploits.csv and rapid7/metasploit-framework).",
+    "ai_discovered": false,
+    "ai_discovery_notes": "Found by named human researchers through Trend Micro's Zero Day Initiative and reported to Progress. ZDI published three advisories for this CVE on 2026-06-09, one per vulnerable endpoint: ZDI-26-342 (apiuser, CVSS 9.8) and ZDI-26-340 (dodelapikey, 8.8) credit Syed Ibrahim Ahmed of TrendAI Research; ZDI-26-341 (dolistapikeys, 7.2) credits Jacky Yang and Syed Ibrahim Ahmed. That trio is why CISA's KEV summary describes unsanitized input across \"multiple command endpoints\". Note for future curators: \"TrendAI Research\" is Trend Micro's own branding for ZDI's research arm, not a statement that the bug was found with AI tooling — no AI assistance is credited in any of the three advisories, in the Progress bulletin, or in the watchTowr analysis.",
+    "ai_assisted_weaponization": false,
+    "affected": "Progress Kemp LoadMaster application delivery controller (and the Progress ECS Connection Manager / Connection Manager for ObjectScale builds derived from it), on appliances where the management API is enabled.",
+    "affected_versions": [
+      "Kemp LoadMaster GA <= 7.2.63.1 (fixed in 7.2.63.2)",
+      "Kemp LoadMaster LTSF <= 7.2.54.17 (fixed in 7.2.54.18)",
+      "Progress ECS Connection Manager < 7.2.63.2",
+      "Progress Connection Manager for ObjectScale < 7.2.63.2",
+      "Only reachable when the LoadMaster API is enabled"
+    ],
+    "complexity_notes": "AC:L with PR:N and UI:N — no credentials, no user interaction and no race. The exploit is a single JSON POST that both sprays the heap and triggers the allocation, and the published Nuclei template does it in one request. The one real gate is reachability: the CVSS vector is AV:A (adjacent), because the LoadMaster API normally listens on a management network rather than the internet, and the flaw is only reachable when that API is enabled. CISA's SSVC decision records exploitation=active, automatable=no, technicalImpact=total.",
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch or hot-patch mechanism exists for LoadMaster — remediation is a firmware upgrade and an appliance restart, which on a device carrying all site traffic is maintenance-window work. Progress fixed it on 2026-06-04: upgrade the GA line to 7.2.63.2 or later and the long-term-support line to 7.2.54.18 or later; ECS Connection Manager and Connection Manager for ObjectScale take the same 7.2.63.2 baseline. There is a genuine configuration-side mitigation that needs no upgrade, because the flaw is only reachable through the management API: disable the API where it is not required, or restrict it to a management network the attacker cannot reach — the CVSS vector is AV:A precisely because that interface is not normally internet-facing. Any appliance that was reachable and unpatched should be treated as a compromise-recovery case rather than a patch case: command execution lands on the device terminating TLS for the applications behind it.",
+    "blast_radius": 24,
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 flaw remediation ran out of room here. Progress published the fix on 2026-06-04 and ZDI published three advisories on 2026-06-09; watchTowr published the full root-cause diff on 2026-06-29, handing anyone the exact patched function; and CISA did not list it until 2026-08-07 with a three-day due date. An organisation on a routine monthly or quarterly appliance-patch cadence was inside a two-month window in which the bug was public at byte level and the appliance was still unpatched.",
+      "EU-CRA-Art13": "CRA Art.13 obliges manufacturers to ship products without known exploitable vulnerabilities and to handle them across the support period, but the defect here is a memory-safety mistake in a shell-argument escaper — malloc() without a null terminator — inside a security appliance whose entire job is to be the trusted boundary. Nothing in the essential requirements forces the deployer to treat their own edge ADC as an attack surface with a distinct patch clock, so the obligation lands on Progress while the exposure sits with the operator.",
+      "UK-CAF-B4": "CAF B4 asks for hardened, minimised builds, and the minimisation that mattered here is one operators can actually perform: the flaw is only reachable when the LoadMaster management API is enabled. B4 assessments routinely record an appliance as hardened because its data-plane configuration is tight, without asking whether the management API is on and who can reach it — which is the single control that reduces this from pre-auth RCE to unreachable.",
+      "AU-Essential-8-Patch": "The Essential Eight patching control sets a 48-hour target for internet-facing services with a working exploit, measured from vendor release. It fits this CVE badly in both directions: the LoadMaster API is normally on a management network rather than the internet, so the appliance may not be classed internet-facing at all and inherits the slower band — while the device it protects terminates TLS for everything behind it, and CISA's own SSVC rates technical impact total.",
+      "ISO-27001-2022-A.8.8": "A.8.8 prioritises technical vulnerabilities by risk, and the risk signal here was unusually loud — EPSS 0.85, in the 99.7th percentile, with a Nuclei template in the public catalog. But A.8.8 has no concept of a control-plane asset whose compromise invalidates the controls layered on it: taking the ADC gives an attacker the TLS keys, the traffic and the WAF that other A.8 controls assume are intact, so scheduling this like an ordinary server patch understates what is actually at stake."
+    },
+    "atlas_refs": [],
+    "attack_refs": [
+      "T1190",
+      "T1059.004"
+    ],
+    "rwep_score": 79,
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 24,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-08",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Curated from NVD CVE-2026-8037 (CWE-77, CVSS 9.6) + CISA KEV (added 2026-08-07) + Progress vendor advisory and ZDI advisory ZDI-26-342.",
+    "iocs": {
+      "behavioral": [
+        "An unauthenticated POST to /accessv2 whose JSON body carries an apiuser value consisting of single quotes (the published template uses \"''''\") — the quote is what forces escape_quotes() down its malloc() path, so a quote-only username is the trigger rather than a credential guess.",
+        "The same request body carrying dozens of otherwise-meaningless sibling keys (g0 through g60 in the public template), each holding an identical padded string ending in a shell metacharacter sequence such as \"'; <command> #\" — a heap spray, not parameters the API defines.",
+        "Shell commands executing as the LoadMaster service account with no preceding successful API authentication event, and any outbound connection from the appliance that is not normal management or health-check traffic."
+      ],
+      "indicators": [
+        "HTTP 200 responses from /accessv2 with Content-Type text/json whose body contains command output rather than an API result — the public template matches on root:x:0:0: from /etc/passwd.",
+        "Kemp LoadMaster on GA 7.2.63.1 or older, or LTSF 7.2.54.17 or older, with the management API enabled; equivalently Progress ECS Connection Manager or Connection Manager for ObjectScale below 7.2.63.2.",
+        "Any /accessv2 request whose apiuser field contains a single-quote character at all — the field is a username and has no legitimate reason to carry one."
+      ],
+      "_ioc_source_note": "poc_available is true, so the specific public source is named: the ProjectDiscovery Nuclei template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-8037.yaml, from which the /accessv2 endpoint, the quote-only apiuser value, the g0..g60 heap spray and the text/json + root:x:0:0: match conditions are read verbatim; plus the public exploit repositories github.com/Caster-chen/CVE-2026-8037-POC and github.com/HORKimhab/CVE-2026-8037. Root cause (malloc without null-termination in escape_quotes(), fixed by calloc plus an explicit terminator in 7.2.63.2) from watchTowr Labs' binary diff at https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/. Anchored to NVD CVE-2026-8037 (CWE-77, CVSS 9.6 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scored by security@progress.com, CISA SSVC exploitation=active/automatable=no/technicalImpact=total) and CISA KEV catalogVersion 2026.08.07 (dateAdded 2026-08-07, dueDate 2026-08-10, knownRansomwareCampaignUse Unknown, cwes CWE-77)."
+    },
+    "_intake_method": "batch-curated"
   }
 }