@blamejs/exceptd-skills 0.19.1 → 0.19.3

package/data/cve-catalog.json

@@ -304,7 +304,7 @@
     "complexity": "low",
     "vector": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.",
     "epss_score": 0.71391,
-    "epss_percentile": 0.95846,
+    "epss_percentile": 0.99355,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-16232",
     "vendor_advisories": [
@@ -399,7 +399,7 @@
     "complexity": "low",
     "vector": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
     "epss_score": 0.7576,
-    "epss_percentile": 0.98975,
+    "epss_percentile": 0.99476,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-50522",
     "vendor_advisories": [
@@ -1312,7 +1312,7 @@
     "complexity": "low",
     "vector": "Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.",
     "epss_score": 0.46709,
-    "epss_percentile": 0.98914,
+    "epss_percentile": 0.98708,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-37580",
     "vendor_advisories": [
@@ -11737,7 +11737,7 @@
     "complexity": "low",
     "vector": "Windows Kernel Elevation of Privilege Vulnerability",
     "epss_score": 0.5981,
-    "epss_percentile": 0.98833,
+    "epss_percentile": 0.99044,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21338",
     "vendor_advisories": [
@@ -13903,7 +13903,7 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura 13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.",
-    "epss_score": 0.01145,
+    "epss_score": 0.01347,
     "epss_percentile": 0.68783,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-41990",
@@ -20737,7 +20737,7 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
-    "epss_score": 0.01296,
+    "epss_score": 0.05985,
     "epss_percentile": 0.92603,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-58644",
@@ -20829,7 +20829,7 @@
     "complexity": "low",
     "vector": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",
     "epss_score": 0.73603,
-    "epss_percentile": 0.97528,
+    "epss_percentile": 0.99418,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-25089",
     "vendor_advisories": [
@@ -20924,7 +20924,7 @@
     "complexity": "low",
     "vector": "OS command injection in the FortiSandbox management interface (CWE-78). An unauthenticated attacker injects shell metacharacters into the `jid` parameter of the /fortisandbox/job-detail/tracer-behavior endpoint; the value reaches an underlying OS command without sanitization, yielding remote code execution as root. Affects FortiSandbox 4.4.0 through 4.4.8 and FortiSandbox PaaS builds. Reconstructed from the Fortinet PSIRT advisory (FG-IR-26-100) and public exploitation reporting, as the upstream NVD record shipped without a documented attack vector.",
     "epss_score": 0.9121,
-    "epss_percentile": 0.9874,
+    "epss_percentile": 0.99801,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-39808",
     "vendor_advisories": [
@@ -21216,7 +21216,7 @@
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.",
-    "epss_score": 0.00379,
+    "epss_score": 0.02333,
     "epss_percentile": 0.81925,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-56155",
@@ -21587,7 +21587,7 @@
     "complexity": "low",
     "vector": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.  NOTE: some of these details are obtained from third party information.",
     "epss_score": 0.32953,
-    "epss_percentile": 0.97573,
+    "epss_percentile": 0.98197,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2008-4128",
     "vendor_advisories": [
@@ -30614,7 +30614,7 @@
     "complexity": "low",
     "vector": "ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",
     "epss_score": 0.99197,
-    "epss_percentile": 0.97907,
+    "epss_percentile": 0.99931,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48282",
     "vendor_advisories": [
@@ -38039,7 +38039,7 @@
     "complexity": "low",
     "vector": "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.",
     "epss_score": 0.23184,
-    "epss_percentile": 0.98139,
+    "epss_percentile": 0.97548,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-9680",
     "vendor_advisories": [
@@ -38707,7 +38707,7 @@
     "complexity": "low",
     "vector": "Microsoft Management Console Remote Code Execution Vulnerability",
     "epss_score": 0.66571,
-    "epss_percentile": 0.99047,
+    "epss_percentile": 0.99214,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-43572",
     "vendor_advisories": [
@@ -39600,7 +39600,7 @@
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=24. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.0912,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.0912 (95th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-45659",
     "cwe_refs": [
       "CWE-502"
@@ -39642,7 +39642,8 @@
     "_kev_short_description": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.94809
   },
   "CVE-2026-48558": {
     "name": "SimpleHelp Authentication Bypass Vulnerability",
@@ -39705,7 +39706,7 @@
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=20. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.11484,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.11484 (96th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48558",
     "cwe_refs": [
       "CWE-347"
@@ -39747,7 +39748,8 @@
     "_kev_short_description": "SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 10 and CWE(s) CWE-347 retained; ATT&CK + IOCs derived from the Auth-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.95595
   },
   "CVE-2025-26633": {
     "name": "Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability",
@@ -39808,9 +39810,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=27. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.31894,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.30391,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.30391 (98th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-26633",
     "cwe_refs": [
       "CWE-707"
@@ -39859,7 +39861,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7 and CWE(s) CWE-707 retained; ATT&CK + IOCs derived from the Security-Feature-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7 and CWE(s) CWE-707 retained; ATT&CK + IOCs derived from the Security-Feature-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.98055
   },
   "CVE-2024-13161": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForSingleFile)",
@@ -39918,9 +39921,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.88518,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.89829,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.89829 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-13161",
     "cwe_refs": [
       "CWE-36"
@@ -39970,7 +39973,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.99779
   },
   "CVE-2024-13160": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcard)",
@@ -40029,9 +40033,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.89738,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.91004,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.91004 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-13160",
     "cwe_refs": [
       "CWE-36"
@@ -40081,7 +40085,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.99798
   },
   "CVE-2024-13159": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcardRecursive)",
@@ -40140,9 +40145,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.99762,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.99835,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.99835 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-13159",
     "cwe_refs": [
       "CWE-36"
@@ -40192,7 +40197,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.9996
   },
   "CVE-2024-57968": {
     "name": "Advantive VeraCore Unrestricted File Upload Vulnerability",
@@ -40251,9 +40257,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=14. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.30477,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.32514,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.32514 (98th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-57968",
     "cwe_refs": [
       "CWE-434"
@@ -40294,7 +40300,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.9 and CWE(s) CWE-434 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.9 and CWE(s) CWE-434 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.98173
   },
   "CVE-2025-25181": {
     "name": " Advantive VeraCore SQL Injection Vulnerability",
@@ -40353,9 +40360,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=14. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.50557,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.50863,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.50863 (99th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-25181",
     "cwe_refs": [
       "CWE-89"
@@ -40403,7 +40410,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.8 and CWE(s) CWE-89 retained; ATT&CK + IOCs derived from the SQL-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.8 and CWE(s) CWE-89 retained; ATT&CK + IOCs derived from the SQL-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.98819
   },
   "CVE-2024-50302": {
     "name": "Linux Kernel Use of Uninitialized Resource Vulnerability",
@@ -40463,8 +40471,8 @@
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=20. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.00809,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00809 (53rd percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-50302",
     "cwe_refs": [
       "CWE-908"
@@ -40505,7 +40513,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.5 and CWE(s) CWE-908 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.5 and CWE(s) CWE-908 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.53493
   },
   "CVE-2024-4885": {
     "name": "Progress WhatsUp Gold Path Traversal Vulnerability",
@@ -40564,9 +40573,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.99288,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.99269,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.99269 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-4885",
     "cwe_refs": [
       "CWE-22"
@@ -40611,7 +40620,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-22 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-22 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.99932
   },
   "CVE-2018-8639": {
     "name": "Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability",
@@ -40670,8 +40680,8 @@
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.22349,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.22349 (97th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2018-8639",
     "cwe_refs": [
       "CWE-404"
@@ -40718,7 +40728,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7.8 and CWE(s) CWE-404 retained; ATT&CK + IOCs derived from the LPE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7.8 and CWE(s) CWE-404 retained; ATT&CK + IOCs derived from the LPE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.97458
   },
   "CVE-2022-43769": {
     "name": "Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability",
@@ -40778,8 +40789,8 @@
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=15. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.9767,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.9767 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2022-43769",
     "cwe_refs": [
       "CWE-74",
@@ -40827,7 +40838,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-74/CWE-94 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-74/CWE-94 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.99898
   },
   "CVE-2022-43939": {
     "name": "Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability",
@@ -40887,8 +40899,8 @@
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=15. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.92266,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.92266 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2022-43939",
     "cwe_refs": [
       "CWE-647"
@@ -40932,7 +40944,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.6 and CWE(s) CWE-647 retained; ATT&CK + IOCs derived from the Authorization-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.6 and CWE(s) CWE-647 retained; ATT&CK + IOCs derived from the Authorization-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.99814
   },
   "CVE-2023-20118": {
     "name": "Cisco Small Business RV Series Routers Command Injection Vulnerability",
@@ -40991,9 +41004,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.53827,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.54107,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.54107 (99th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-20118",
     "cwe_refs": [
       "CWE-77"
@@ -41041,7 +41054,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-77 retained; ATT&CK + IOCs derived from the Command-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-77 retained; ATT&CK + IOCs derived from the Command-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.98908
   },
   "CVE-2023-34192": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability",
@@ -41100,8 +41114,8 @@
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=16. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.77266,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.77266 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-34192",
     "cwe_refs": [
       "CWE-79"
@@ -41142,7 +41156,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9 and CWE(s) CWE-79 retained; ATT&CK + IOCs derived from the XSS mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9 and CWE(s) CWE-79 retained; ATT&CK + IOCs derived from the XSS mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.9951
   },
   "CVE-2024-49035": {
     "name": "Microsoft Partner Center Improper Access Control Vulnerability",
@@ -41201,8 +41216,8 @@
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=17. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.01339,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01339 (69th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-49035",
     "cwe_refs": [
       "CWE-269"
@@ -41243,7 +41258,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.7 and CWE(s) CWE-269 retained; ATT&CK + IOCs derived from the Privilege-Escalation mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.7 and CWE(s) CWE-269 retained; ATT&CK + IOCs derived from the Privilege-Escalation mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.68604
   },
   "CVE-2024-20953": {
     "name": "Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability",
@@ -41302,8 +41318,8 @@
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=14. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.03405,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.03405 (88th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-20953",
     "cwe_refs": [
       "CWE-502"
@@ -41344,7 +41360,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.87721
   },
   "CVE-2017-3066": {
     "name": "Adobe ColdFusion Deserialization Vulnerability",
@@ -41405,8 +41422,8 @@
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
     "epss_score": 0.90597,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.90597 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2017-3066",
     "cwe_refs": [
       "CWE-502"
@@ -41451,7 +41468,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.99792
   },
   "CVE-2025-24989": {
     "name": "Microsoft Power Pages Improper Access Control Vulnerability",
@@ -41509,9 +41527,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P3 — KEV-listed confirmed exploitation. blast_radius=16. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.01659,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01722,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01722 (75th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24989",
     "cwe_refs": [
       "CWE-284"
@@ -41552,7 +41570,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.2 and CWE(s) CWE-284 retained; ATT&CK + IOCs derived from the Improper-Access-Control mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.2 and CWE(s) CWE-284 retained; ATT&CK + IOCs derived from the Improper-Access-Control mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.75323
   },
   "CVE-2025-0111": {
     "name": "Palo Alto Networks PAN-OS File Read Vulnerability",
@@ -41614,9 +41633,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22. Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium (Σ factors === rwep_score).",
-    "epss_score": 0.01862,
-    "epss_date": "2026-07-03",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01927,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01927 (78th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-0111",
     "cwe_refs": [
       "CWE-73",
@@ -41667,7 +41686,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-73/CWE-610 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV)."
+    "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-73/CWE-610 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
+    "epss_percentile": 0.78015
   },
   "CVE-2022-23812": {
     "name": "node-ipc geo-targeted file-wiper protestware (RU/BY heart-emoji overwrite; peacenotwar dropper in 11.0.0+)",
@@ -42222,7 +42242,7 @@
     "rwep_notes": "RWEP 85. KEV (+25) + PoC/in-wild tradecraft (+20) + confirmed exploitation (+20) + blast_radius 30 (every internet-facing Connect Secure appliance; nation-state initial access plus later ransomware use) - patch_available (-15) + reboot_required (+5). Live-patch credit unavailable (appliance firmware). Σ factors === rwep_score.",
     "epss_score": 0.99971,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.94129 (99.92nd percentile) as of 2026-05-28.",
+    "epss_note": "FIRST EPSS 0.99971 (100th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-0282",
     "cwe_refs": [
       "CWE-121",
@@ -42264,7 +42284,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121), zero-day exploited by a China-nexus cluster with the SPAWN malware ecosystem; patch to 22.7R2.5 and rebuild on any ICT compromise indicator.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99979
   },
   "CVE-2025-22457": {
     "ai_assisted_weaponization": false,
@@ -42330,7 +42351,7 @@
     "rwep_notes": "RWEP 83. KEV (+25) + in-wild tradecraft (+20) + confirmed exploitation (+20) + blast_radius 28 (internet-facing Connect Secure fleet; weaponized follow-on to CVE-2025-0282) - patch_available (-15) + reboot_required (+5). Σ factors === rwep_score.",
     "epss_score": 0.9999,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.58941 (98.25th percentile) as of 2026-05-28.",
+    "epss_note": "FIRST EPSS 0.9999 (100th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-22457",
     "cwe_refs": [
       "CWE-121",
@@ -42372,7 +42393,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121) initially mis-triaged as DoS then weaponized; patch to 22.7R2.6 and rebuild on compromise indicators.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99985
   },
   "CVE-2025-31324": {
     "ai_assisted_weaponization": false,
@@ -42433,7 +42455,7 @@
     "rwep_notes": "RWEP 78. KEV (+25) + PoC/webshell IOCs (+20) + confirmed mass exploitation (+20) + blast_radius 28 (internet-facing SAP NetWeaver ERP install base; webshell-to-ransomware chain) - patch_available (-15). No reboot. Σ factors === rwep_score.",
     "epss_score": 0.99512,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.31510 (96.87th percentile) as of 2026-05-28.",
+    "epss_note": "FIRST EPSS 0.99512 (100th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31324",
     "cwe_refs": [
       "CWE-434"
@@ -42477,7 +42499,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "SAP NetWeaver Visual Composer Metadata Uploader missing-authorization file upload (CWE-434) → unauthenticated RCE via JSP webshell; apply SAP Note 3594142 and hunt for webshells.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99941
   },
   "CVE-2025-31161": {
     "ai_assisted_weaponization": false,
@@ -42540,7 +42563,7 @@
     "rwep_notes": "RWEP 76. KEV (+25) + public exploitation details (+20) + confirmed exploitation, ransomware-flagged (+20) + blast_radius 26 (internet-facing MFT servers; admin takeover, data-extortion class) - patch_available (-15). No reboot. Σ factors === rwep_score.",
     "epss_score": 0.99947,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.88937 (99.54th percentile) as of 2026-05-28.",
+    "epss_note": "FIRST EPSS 0.99947 (100th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31161",
     "cwe_refs": [
       "CWE-305"
@@ -42581,7 +42604,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "CrushFTP HTTP authorization-header authentication bypass (CWE-305) → crushadmin takeover; upgrade to 10.8.4/11.3.1 or front with a DMZ proxy.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99974
   },
   "CVE-2025-30066": {
     "name": "tj-actions/changed-files GitHub Action Supply-Chain Compromise (secret exfiltration to workflow logs)",
@@ -42648,7 +42672,7 @@
     "rwep_notes": "Critical (RWEP 78). KEV-listed (25) + confirmed in-the-wild exploitation (20) + the live malicious artifact as PoC (20) + very large blast radius (28; ~23,000 dependent repositories, secrets exfiltrated), minus patch_available (15). Σ factors === rwep_score.",
     "epss_score": 0.72391,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.9183 (99.70th percentile) as of 2026-05-27.",
+    "epss_note": "FIRST EPSS 0.72391 (99th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-30066",
     "iocs": {
       "behavioral": [
@@ -42691,7 +42715,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "tj-actions/changed-files GitHub Action tags were repointed to malicious code (CWE-506) that dumped CI/CD secrets to publicly readable workflow logs; remediate by pinning actions to commit SHAs and rotating exposed secrets.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99383
   },
   "CVE-2025-30154": {
     "name": "reviewdog/action-setup GitHub Action Supply-Chain Compromise (secret exfiltration to workflow logs)",
@@ -42763,7 +42788,7 @@
     "rwep_notes": "Critical (RWEP 72). KEV-listed (25) + confirmed exploitation (20) + live malicious artifact as PoC (20) + broad transitive blast radius (22; five downstream actions, defeated consumer SHA pinning), minus patch_available (15). Σ factors === rwep_score.",
     "epss_score": 0.02296,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.34556 (97.07th percentile) as of 2026-05-27.",
+    "epss_note": "FIRST EPSS 0.02296 (82nd percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-30154",
     "iocs": {
       "behavioral": [
@@ -42801,7 +42826,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "reviewdog/action-setup@v1 (and five reviewdog actions that include it transitively) was trojaned (CWE-506) to dump secrets to workflow logs; pin actions to commit SHAs and rotate exposed secrets.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.81623
   },
   "CVE-2026-48027": {
     "name": "Nx Console IDE Extension Supply-Chain Compromise (malicious marketplace version)",
@@ -42978,7 +43004,7 @@
       "reboot_required": 0
     },
     "rwep_notes": "RWEP recomputed in v0.12.6 after CVSS 9.6→7.8 correction. AV:L (local) reduces blast_radius weight; vendor patch + auto-updating IDE reduce live_patch_available impact.",
-    "epss_score": 0.046,
+    "epss_score": 0.02568,
     "epss_percentile": 0.83649,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-53773",
@@ -43362,7 +43388,7 @@
       "reboot_required": 0
     },
     "rwep_notes": "P3 — patch available, mitigation via tool disable, but the class (AI-mediated argument injection into infrastructure tools) is operationally important to track.",
-    "epss_score": 0.00039,
+    "epss_score": 0.00258,
     "epss_percentile": 0.1734,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-39884",
@@ -43465,7 +43491,7 @@
     },
     "rwep_notes": "Operationally P1 — KEV-listed, network-vector, no auth, full credential DB compromise. AI-stack fleets running LiteLLM as the gateway should patch within the KEV 21-day window at minimum.",
     "epss_score": 0.8942,
-    "epss_percentile": 0.9722,
+    "epss_percentile": 0.99771,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-42208",
     "cwe_refs": [
@@ -43899,7 +43925,7 @@
       "reboot_required": 0
     },
     "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +30, patch_available -15, live_patch_available -10. Σ factors === rwep_score.",
-    "epss_score": 0.00039,
+    "epss_score": 0.02342,
     "epss_percentile": 0.8201,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-45321",
@@ -44431,7 +44457,9 @@
     "known_ransomware_use": false,
     "active_exploitation_notes": "No in-the-wild exploitation reported. The vulnerability was found by Snyk Labs research and disclosed 2024-01-31 with a proof-of-concept demonstrating the escape; the public exploit code is that disclosure PoC, not a captured intrusion artifact. CISA has never listed it in the Known Exploited Vulnerabilities catalog, and KEV's listing criterion is reliable evidence of active exploitation.",
     "rwep_notes": "RWEP 35. poc_available +20, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.96913,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21626"
   },
   "CVE-2024-3094": {
     "ai_assisted_weaponization": false,
@@ -44489,8 +44517,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.86,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.85974,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-506",
       "CWE-1357"
@@ -44530,7 +44558,9 @@
     },
     "known_ransomware_use": false,
     "rwep_notes": "RWEP 45. poc_available +20, active_exploitation +10, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.9971,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3094"
   },
   "CVE-2024-3154": {
     "ai_assisted_weaponization": false,
@@ -44587,8 +44617,8 @@
       "live_patch_available": -10,
       "reboot_required": 0
     },
-    "epss_score": 0.012,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.01418,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-20"
     ],
@@ -44606,7 +44636,9 @@
         "newly present kernel modules in /proc/modules on a worker node with no matching node-image or DaemonSet provenance."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2024-3154 and the cri-o GitHub security advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.70262,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3154"
   },
   "CVE-2023-43472": {
     "ai_assisted_weaponization": false,
@@ -44680,7 +44712,9 @@
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2023-43472 and the Protect AI Huntr report cited in verification_sources."
     },
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.98346,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-43472"
   },
   "CVE-2020-10148": {
     "ai_assisted_weaponization": false,
@@ -44733,8 +44767,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.945,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.9198,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-287"
     ],
@@ -44768,7 +44802,9 @@
         "Orion server initiating outbound C2 after a dormancy period, with traffic masqueraded as the Orion Improvement Program protocol."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2020-10148 and CISA advisory AA20-352A (SolarWinds SUNBURST)."
-    }
+    },
+    "epss_percentile": 0.9981,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-10148"
   },
   "CVE-2023-3519": {
     "ai_assisted_weaponization": false,
@@ -44822,8 +44858,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.967,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.99715,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-787"
     ],
@@ -44858,7 +44894,9 @@
         "An internet-facing NetScaler ADC/Gateway configured as a Gateway/AAA virtual server below the patched build."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2023-3519 and Citrix advisory CTX561482."
-    }
+    },
+    "epss_percentile": 0.99951,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-3519"
   },
   "CVE-2024-1709": {
     "ai_assisted_weaponization": false,
@@ -44910,8 +44948,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.973,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.99959,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-287",
       "CWE-288"
@@ -44953,7 +44991,9 @@
         "ScreenConnect deploying unexpected extensions or remote-control tooling immediately after the setup-wizard access."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2024-1709 and the ConnectWise ScreenConnect 23.9.8 security bulletin."
-    }
+    },
+    "epss_percentile": 0.99976,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-1709"
   },
   "CVE-2026-20182": {
     "ai_assisted_weaponization": false,
@@ -45050,7 +45090,9 @@
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2026-20182, CISA KEV, and the Cisco security advisory."
     },
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99787,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20182"
   },
   "CVE-2024-40635": {
     "ai_assisted_weaponization": false,
@@ -45102,8 +45144,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.005,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.00282,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-200"
     ],
@@ -45123,7 +45165,9 @@
         "Cross-namespace network reachability or address-mask leakage between containers that should be CNI-isolated."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2024-40635 and the containerd GitHub security advisory / Snyk Labs PoC cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.20357,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-40635"
   },
   "MAL-2026-TANSTACK-MINI": {
     "ai_assisted_weaponization": false,
@@ -45266,8 +45310,8 @@
       "live_patch_available": -10,
       "reboot_required": 0
     },
-    "epss_score": 0.02,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.05952,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-78",
       "CWE-88"
@@ -45287,7 +45331,9 @@
         "Unexpected subprocess execution (shells, downloaders) parented to the MCP client process at server-launch time."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2026-30623 and the anthropic MCP SDK GitHub security advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.92569,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-30623"
   },
   "CVE-2025-12686": {
     "ai_assisted_weaponization": false,
@@ -45337,8 +45383,8 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.04,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.02762,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-78"
     ],
@@ -45357,7 +45403,9 @@
         "Command-shell or unexpected child processes spawned by the BeeStation web management service without a preceding authenticated session."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-12686 and the Zero Day Initiative Pwn2Own Ireland 2025 disclosure cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.84882,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-12686"
   },
   "CVE-2025-62847": {
     "ai_assisted_weaponization": false,
@@ -45409,8 +45457,8 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.03,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.00809,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-78"
     ],
@@ -45429,7 +45477,9 @@
         "Unexpected command-shell or child processes spawned by QTS/QuTS hero web services without a corresponding administrative action."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-62847 and the QNAP security advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.5349,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62847"
   },
   "CVE-2025-62848": {
     "ai_assisted_weaponization": false,
@@ -45481,8 +45531,8 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.03,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.00853,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-94"
     ],
@@ -45501,7 +45551,9 @@
         "QTS/QuTS hero management processes evaluating attacker-supplied script/code fragments not present in stock firmware."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-62848 and the QNAP security advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.54875,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62848"
   },
   "CVE-2025-62849": {
     "ai_assisted_weaponization": false,
@@ -45553,8 +45605,8 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.02,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.00956,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-269"
     ],
@@ -45573,7 +45625,9 @@
         "Post-authentication privilege transitions on the appliance not initiated through a legitimate admin role assignment."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-62849 and the QNAP security advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.58102,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62849"
   },
   "CVE-2025-59389": {
     "ai_assisted_weaponization": false,
@@ -45622,8 +45676,8 @@
       "live_patch_available": 0,
       "reboot_required": 5
     },
-    "epss_score": 0.05,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.00605,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-78"
     ],
@@ -45642,7 +45696,9 @@
         "Command-shell or unexpected child processes spawned by the Hyper Data Protector backup-orchestration service without a preceding authenticated session."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-59389 and the QNAP / Pwn2Own Ireland 2025 advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.45668,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-59389"
   },
   "CVE-2025-11837": {
     "ai_assisted_weaponization": false,
@@ -45694,8 +45750,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.025,
-    "epss_date": "2026-05-14",
+    "epss_score": 0.01463,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-94"
     ],
@@ -45713,7 +45769,9 @@
         "The malware-definition-fetch channel redirected/hijacked (download from an unexpected host or over a tampered channel) supplying attacker-controlled content."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-11837 and the QNAP security advisory cited in verification_sources."
-    }
+    },
+    "epss_percentile": 0.71129,
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-11837"
   },
   "CVE-2026-42945": {
     "name": "NGINX Rift",
@@ -62675,7 +62733,7 @@
     "affected_versions": [
       "Microsoft Defender Antimalware Platform >= 4.18.26030.3011, < 4.18.26040.7"
     ],
-    "vector": "Uncontrolled resource consumption (CWE-400) in the Microsoft Defender antimalware platform, reachable over the network without authentication, lets an attacker crash or hang Defender. Because the result is loss of AV/EDR availability, the bug is a defense-impairment primitive (ATT&CK T1562.001): an attacker can disable endpoint protection ahead of, or during, an intrusion.",
+    "vector": "Uncontrolled resource consumption (CWE-400) in the Microsoft Defender antimalware platform, reachable over the network without authentication, lets an attacker crash or hang Defender. Because the result is loss of AV/EDR availability, the bug is a defense-impairment primitive (ATT&CK T1685): an attacker can disable endpoint protection ahead of, or during, an intrusion.",
     "complexity": "low",
     "complexity_notes": "NVD AV:N / AC:L / PR:N / UI:N — remote, unauthenticated, low-complexity. Availability-only (C:N/I:N/A:H).",
     "patch_available": true,
@@ -86195,9 +86253,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate-high (RWEP 31, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 0.14.0 (Hard Rule #3): poc_available=20 + blast_radius=26 (full-read SSRF + arbitrary file read + potential RCE via an unsandboxed headless browser in a widely deployed RAG engine), minus patch_available 15.",
-    "epss_score": 0.00984,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00984 (77th percentile) as of 2026-05-26.",
+    "epss_score": 0.01211,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01211 (66th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-12450",
     "cwe_refs": [
       "CWE-918",
@@ -86244,7 +86302,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2024-12450 (CVSS v3.1 9.8, CWE-918) + the huntr bounty (CNA, v3.0 6.5). RAGFlow RAG-engine ingestion SSRF + arbitrary file read; reuses the AI-data-pipeline import SSRF control NEW-CTRL-105 (shared with the Dify RemoteFileUploadApi and Label Studio data-pipeline SSRF).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "RAGFlow web_crawl does not filter the supplied URL, yielding full-read SSRF, file:// arbitrary file read, and potential RCE via an unsandboxed headless Chromium (CWE-918 / CWE-77); fixed in 0.14.0."
+    "_kev_short_description": "RAGFlow web_crawl does not filter the supplied URL, yielding full-read SSRF, file:// arbitrary file read, and potential RCE via an unsandboxed headless Chromium (CWE-918 / CWE-77); fixed in 0.14.0.",
+    "epss_percentile": 0.65582
   },
   "CVE-2025-69286": {
     "name": "RAGFlow Predictable API-Key / Share-Token Account Takeover",
@@ -86307,9 +86366,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate (RWEP 28, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 0.22.0 (Hard Rule #3): poc_available=20 + blast_radius=23 (account takeover including admin in a widely deployed RAG engine, gated on obtaining a shared assistant/agent URL), minus patch_available 15.",
-    "epss_score": 0.00125,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00125 (31st percentile) as of 2026-05-26.",
+    "epss_score": 0.00501,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00501 (40th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-69286",
     "cwe_refs": [
       "CWE-340"
@@ -86347,7 +86406,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-69286 (CVSS v3.1 9.8, CWE-340) + the GitHub Security Advisory GHSA-9j5g-g4xm-57w7 (CNA, CVSS v4.0 8.9). RAGFlow RAG-engine predictable-token account takeover; introduces the AI-app API-token generation-integrity control NEW-CTRL-109.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "RAGFlow generates API keys and share tokens with a predictable serializer keyed by tenant_id over a UUIDv1, so the tokens are mutually derivable and a shared link yields account takeover (CWE-340); fixed in 0.22.0."
+    "_kev_short_description": "RAGFlow generates API keys and share tokens with a predictable serializer keyed by tenant_id over a UUIDv1, so the tokens are mutually derivable and a shared link yields account takeover (CWE-340); fixed in 0.22.0.",
+    "epss_percentile": 0.40192
   },
   "CVE-2026-22218": {
     "name": "Chainlit /project/element Arbitrary File Read",
@@ -86411,7 +86471,7 @@
     "rwep_notes": "Moderate (RWEP 19, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 2.9.4 (Hard Rule #3): poc_available=20 + blast_radius=14 (authenticated arbitrary file read in a widely used LLM app framework - host secrets/config readable), minus patch_available 15.",
     "epss_score": 0.08845,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.00044 (14th percentile) as of 2026-05-26.",
+    "epss_note": "FIRST EPSS 0.08845 (95th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-22218",
     "cwe_refs": [
       "CWE-22"
@@ -86450,7 +86510,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Chainlit /project/element copies a caller-supplied file path into the user's session without validation, letting an authenticated client read arbitrary host files (CWE-22); fixed in 2.9.4.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.94693
   },
   "CVE-2026-22219": {
     "name": "Chainlit /project/element SQLAlchemy-Backend Server-Side Request Forgery",
@@ -86513,9 +86574,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate-high (RWEP 23, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 2.9.4 (Hard Rule #3): poc_available=20 + blast_radius=18 (scope-changed SSRF that stores the fetched response - reaches internal services / cloud metadata in a widely used LLM app framework), minus patch_available 15.",
-    "epss_score": 0.00052,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00052 (16th percentile) as of 2026-05-26.",
+    "epss_score": 0.04439,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.04439 (90th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-22219",
     "cwe_refs": [
       "CWE-918"
@@ -86553,7 +86614,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-22219 (CWE-918) + VulnCheck (CNA, CVSS v4.0 8.3). Chainlit LLM-app-framework server-side request forgery; reuses the AI-data-pipeline import SSRF control NEW-CTRL-105 (shared with the Dify RemoteFileUploadApi, RAGFlow web_crawl, and Label Studio data-pipeline SSRFs).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Chainlit /project/element (SQLAlchemy backend) fetches a caller-supplied url server-side and stores the response, letting an authenticated client reach internal services (CWE-918 SSRF); fixed in 2.9.4."
+    "_kev_short_description": "Chainlit /project/element (SQLAlchemy backend) fetches a caller-supplied url server-side and stores the response, letting an authenticated client reach internal services (CWE-918 SSRF); fixed in 2.9.4.",
+    "epss_percentile": 0.90482
   },
   "CVE-2025-68665": {
     "name": "LangChain JS toJSON() 'lc'-Key Serialization Injection",
@@ -86619,9 +86681,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate-high (RWEP 25, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation for the JS variant, patched (Hard Rule #3): poc_available=20 + blast_radius=20 (unauthenticated scope-changed deserialization injection in a widely used LLM framework), minus patch_available 15. Scored below its Python sibling CVE-2025-68664 (RWEP 52), which additionally carries suspected-exploitation + weaponization signals.",
-    "epss_score": 0.00066,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00066 (20th percentile) as of 2026-05-26.",
+    "epss_score": 0.00758,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00758 (52nd percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-68665",
     "cwe_refs": [
       "CWE-502"
@@ -86659,7 +86721,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-68665 (CWE-502) + the LangChain JS GitHub Security Advisory (CNA, CVSS v3.1 8.6). LangChain-JS toJSON() serialization injection — the JavaScript sibling of the Python-side CVE-2025-68664; reuses the LLM-output deserialization trust-zone control NEW-CTRL-064 + AI-tool input-sanitization NEW-CTRL-005.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "LangChain JS toJSON() did not escape the internal 'lc' marker in free-form data, so attacker data is rehydrated as a framework object on deserialization (CWE-502); fixed in @langchain/core 1.1.8 / langchain 1.2.3."
+    "_kev_short_description": "LangChain JS toJSON() did not escape the internal 'lc' marker in free-form data, so attacker data is rehydrated as a framework object on deserialization (CWE-502); fixed in @langchain/core 1.1.8 / langchain 1.2.3.",
+    "epss_percentile": 0.51784
   },
   "CVE-2025-51480": {
     "name": "ONNX save_external_data Path Traversal Arbitrary File Overwrite",
@@ -86724,9 +86787,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate-high (RWEP 23, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 1.18.0 (Hard Rule #3): poc_available=20 + blast_radius=18 (arbitrary file overwrite via a crafted model in the ubiquitous ONNX interchange format - broad reach, but gated on the victim processing the malicious model, UI:R), minus patch_available 15.",
-    "epss_score": 0.00366,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00366 (59th percentile) as of 2026-05-26.",
+    "epss_score": 0.00578,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00578 (44th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-51480",
     "cwe_refs": [
       "CWE-22"
@@ -86764,7 +86827,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-51480 (CWE-22) + GitHub Security Advisory GHSA-6rq9-53c3-f7vj + the Gecko Security writeup. ONNX model-interchange-format path traversal (arbitrary file overwrite on model load/save); reuses the AI-runtime-API path-traversal validation control NEW-CTRL-094 (shared with the AnythingLLM upload traversal and Chainlit element file read).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "ONNX save_external_data does not validate the external_data location, so a crafted model overwrites arbitrary files via path traversal on load/save (CWE-22); fixed in 1.18.0."
+    "_kev_short_description": "ONNX save_external_data does not validate the external_data location, so a crafted model overwrites arbitrary files via path traversal on load/save (CWE-22); fixed in 1.18.0.",
+    "epss_percentile": 0.44443
   },
   "CVE-2025-10164": {
     "name": "SGLang update_weights_from_tensor Unsafe Deserialization RCE",
@@ -86828,9 +86892,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate-high (RWEP 25, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched (Hard Rule #3): poc_available=20 + blast_radius=20 (unsafe-deserialization RCE in a widely used LLM serving framework, gated on the weight-update path receiving untrusted input), minus patch_available 15.",
-    "epss_score": 0.00111,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00111 (29th percentile) as of 2026-05-26.",
+    "epss_score": 0.00376,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00376 (30th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-10164",
     "cwe_refs": [
       "CWE-502",
@@ -86869,7 +86933,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2025-10164 (CWE-502 / CWE-20) + GitHub Security Advisory GHSA-9w53-xr52-mwgj + the Orca Security writeup. SGLang LLM-serving-framework unsafe deserialization RCE; reuses the untrusted-model-artifact loading control NEW-CTRL-091 (shared with the Keras / PyTorch / BentoML deserialization class).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "SGLang update_weights_from_tensor deserializes untrusted serialized-object tensor data, yielding RCE wherever the weight-update path accepts untrusted input (CWE-502); upgrade past 0.4.6."
+    "_kev_short_description": "SGLang update_weights_from_tensor deserializes untrusted serialized-object tensor data, yielding RCE wherever the weight-update path accepts untrusted input (CWE-502); upgrade past 0.4.6.",
+    "epss_percentile": 0.30331
   },
   "CVE-2026-5760": {
     "name": "SGLang /v1/rerank Malicious-Model Jinja2 Template-Injection RCE",
@@ -86934,9 +86999,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "High (RWEP 29, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched (Hard Rule #3): poc_available=20 + blast_radius=24 (unauthenticated CVSS-9.8 template-injection RCE via a malicious model at a network endpoint in a widely used LLM serving framework), minus patch_available 15.",
-    "epss_score": 0.00353,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00353 (58th percentile) as of 2026-05-26.",
+    "epss_score": 0.00852,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00852 (55th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-5760",
     "cwe_refs": [
       "CWE-94"
@@ -86981,7 +87046,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-5760 (CWE-94) + the SGLang GitHub Security Advisory + CERT/CC VU#915947. SGLang LLM-serving-framework malicious-model Jinja2 template-injection RCE; introduces the AI-model template-rendering sandbox control NEW-CTRL-110.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "SGLang /v1/rerank renders a model-supplied jinja2 chat_template in a non-sandboxed Environment, so a malicious model achieves RCE (CWE-94); fix renders with ImmutableSandboxedEnvironment."
+    "_kev_short_description": "SGLang /v1/rerank renders a model-supplied jinja2 chat_template in a non-sandboxed Environment, so a malicious model achieves RCE (CWE-94); fix renders with ImmutableSandboxedEnvironment.",
+    "epss_percentile": 0.54808
   },
   "CVE-2026-21858": {
     "name": "n8n Form-Based Unauthenticated Arbitrary File Access",
@@ -87047,7 +87113,7 @@
     "rwep_notes": "High (RWEP 31, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 1.121.0 (Hard Rule #3): poc_available=20 + blast_radius=26 (unauthenticated CVSS-10.0 arbitrary file read that the public exploit chains into admin-session forgery + Execute Command host RCE on locally deployed instances; >100k internet-reachable instances; elevated EPSS), minus patch_available 15.",
     "epss_score": 0.71647,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.06939 (91st percentile) as of 2026-05-26.",
+    "epss_note": "FIRST EPSS 0.71647 (99th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-21858",
     "cwe_refs": [
       "CWE-20"
@@ -87087,7 +87153,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "n8n 1.65.0-1.120.x lets an unauthenticated attacker access server files via form-based actions without path confinement (CWE-20); fixed in 1.121.0.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99361
   },
   "CVE-2025-68668": {
     "name": "n8n Python Code Node Pyodide Sandbox Bypass RCE",
@@ -87152,7 +87219,7 @@
     "rwep_notes": "Moderate-high (RWEP 27, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 2.0.0 (Hard Rule #3): poc_available=20 + blast_radius=22 (authenticated code-node sandbox escape to host RCE in a widely deployed workflow builder), minus patch_available 15.",
     "epss_score": 0.12901,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.00035 (10th percentile) as of 2026-05-26.",
+    "epss_note": "FIRST EPSS 0.12901 (96th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-68668",
     "cwe_refs": [
       "CWE-693"
@@ -87190,7 +87257,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "n8n's Python Code Node Pyodide sandbox is bypassable, so an authenticated workflow editor runs code with host privileges (CWE-693); fixed in 2.0.0.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.95926
   },
   "CVE-2024-31462": {
     "name": "stable-diffusion-webui Backup/Restore Limited File Write (Path Traversal)",
@@ -87251,9 +87319,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "Moderate (RWEP 17, \"patch within 30 days\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, fixed by commit d9708c92 (1.7.0-1.8.0 affected) (Hard Rule #3): poc_available=20 + blast_radius=12 (limited JSON file write, authenticated, Windows-only, in the most widely deployed Stable Diffusion web UI), minus patch_available 15.",
-    "epss_score": 0.00245,
-    "epss_date": "2026-05-26",
-    "epss_note": "FIRST EPSS 0.00245 as of 2026-05-26.",
+    "epss_score": 0.0068,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.0068 (49th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-31462",
     "cwe_refs": [
       "CWE-22"
@@ -87291,7 +87359,8 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2024-31462 (CWE-22) + GitHub Security Lab GHSL-2024-010. AUTOMATIC1111 stable-diffusion-webui Backup/Restore limited file write; reuses the AI-runtime-API path-traversal validation control NEW-CTRL-094 (shared with the AnythingLLM upload traversal, Chainlit element read, ONNX model overwrite, and n8n form-action file access).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "stable-diffusion-webui (1.7.0 through 1.8.0) Backup/Restore builds a write path from an unvalidated filename, yielding a limited file write on Windows (CWE-22); fixed by commit d9708c92."
+    "_kev_short_description": "stable-diffusion-webui (1.7.0 through 1.8.0) Backup/Restore builds a write path from an unvalidated filename, yielding a limited file write on Windows (CWE-22); fixed by commit d9708c92.",
+    "epss_percentile": 0.48987
   },
   "CVE-2026-3059": {
     "type": "RCE",
@@ -87330,8 +87399,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.01945,
-    "epss_date": "2026-05-26",
+    "epss_score": 0.01534,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-502"
     ],
@@ -87361,7 +87430,7 @@
       "Upgrade SGLang to 0.5.10 or later (PR #20904). Use a safe serializer for IPC, never deserialize untrusted serialized objects, authenticate ZMQ peers, and isolate the channel on a trusted network segment."
     ],
     "rwep_notes": "High (RWEP 31, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 0.5.10 (Hard Rule #3): poc_available=20 + blast_radius=26 (unauthenticated CVSS-9.8 IPC-deserialization RCE in a widely used LLM serving framework), minus patch_available 15.",
-    "epss_note": "FIRST EPSS 0.01945 (84th percentile) as of 2026-05-26.",
+    "epss_note": "FIRST EPSS 0.01534 (72nd percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-3059",
     "iocs": {
       "behavioral": [
@@ -87393,7 +87462,8 @@
       }
     ],
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-3059 (CWE-502) + GitHub Security Advisory GHSA-3cp7-c6q2-94xr + the Orca Security writeup. SGLang LLM-serving-framework unauthenticated IPC-deserialization RCE (multimodal ZMQ broker); reuses the AI-inference IPC deserialization-safety control NEW-CTRL-086 (shared with the vLLM ZeroMQ-transport and TensorRT-LLM deserialization class).",
-    "_kev_short_description": "SGLang's multimodal ZMQ broker deserializes untrusted serialized objects from unauthenticated peers, yielding unauth RCE (CWE-502); fixed in 0.5.10."
+    "_kev_short_description": "SGLang's multimodal ZMQ broker deserializes untrusted serialized objects from unauthenticated peers, yielding unauth RCE (CWE-502); fixed in 0.5.10.",
+    "epss_percentile": 0.72419
   },
   "CVE-2026-3060": {
     "type": "RCE",
@@ -87432,8 +87502,8 @@
       "live_patch_available": 0,
       "reboot_required": 0
     },
-    "epss_score": 0.01945,
-    "epss_date": "2026-05-26",
+    "epss_score": 0.01158,
+    "epss_date": "2026-08-08",
     "cwe_refs": [
       "CWE-502"
     ],
@@ -87463,7 +87533,7 @@
       "Upgrade SGLang to 0.5.10 or later (PR #20904). Use a safe serializer for the disaggregation IPC, never deserialize untrusted serialized objects, authenticate peers, and isolate the channel on a trusted network segment."
     ],
     "rwep_notes": "High (RWEP 31, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 0.5.10 (Hard Rule #3): poc_available=20 + blast_radius=26 (unauthenticated CVSS-9.8 IPC-deserialization RCE in a widely used LLM serving framework), minus patch_available 15.",
-    "epss_note": "FIRST EPSS 0.01945 (84th percentile) as of 2026-05-26.",
+    "epss_note": "FIRST EPSS 0.01158 (64th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-3060",
     "iocs": {
       "behavioral": [
@@ -87495,7 +87565,8 @@
       }
     ],
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-3060 (CWE-502) + the SGLang fix (PR #20904) + the Orca Security writeup. SGLang LLM-serving-framework unauthenticated IPC-deserialization RCE (encoder-parallel disaggregation); reuses the AI-inference IPC deserialization-safety control NEW-CTRL-086.",
-    "_kev_short_description": "SGLang's encoder-parallel disaggregation module deserializes untrusted serialized objects from unauthenticated peers, yielding unauth RCE (CWE-502); fixed in 0.5.10."
+    "_kev_short_description": "SGLang's encoder-parallel disaggregation module deserializes untrusted serialized objects from unauthenticated peers, yielding unauth RCE (CWE-502); fixed in 0.5.10.",
+    "epss_percentile": 0.64084
   },
   "CVE-2026-21877": {
     "name": "n8n Git Node Arbitrary File Write Authenticated RCE",
@@ -87560,7 +87631,7 @@
     "rwep_notes": "High (RWEP 29, \"patch promptly\" band per lib/scoring.js). Not KEV (verified), no confirmed in-the-wild exploitation, patched at 1.121.3 (Hard Rule #3): poc_available=20 + blast_radius=24 (authenticated file-write-to-RCE with full compromise across self-hosted + Cloud, elevated EPSS), minus patch_available 15.",
     "epss_score": 0.05258,
     "epss_date": "2026-08-07",
-    "epss_note": "FIRST EPSS 0.10735 (93rd percentile) as of 2026-05-26.",
+    "epss_note": "FIRST EPSS 0.05258 (92nd percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-21877",
     "cwe_refs": [
       "CWE-434",
@@ -87600,7 +87671,8 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "n8n's Git node lets an authenticated user write a dangerous file to an arbitrary path for RCE and full instance compromise (CWE-434/CWE-94); fixed in 1.121.3.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.91758
   },
   "CVE-2023-51764": {
     "ai_assisted_weaponization": false,
@@ -90987,7 +91059,7 @@
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.62767,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.62767 (99th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34909",
     "cwe_refs": [
       "CWE-22"
@@ -91030,7 +91102,8 @@
     "_kev_short_description": "Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path traversal (arbitrary file read/write), framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99116
   },
   "CVE-2026-34908": {
     "name": "Ubiquiti UniFi OS Improper Access Control Vulnerability",
@@ -91094,7 +91167,7 @@
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.61906,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.61906 (99th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34908",
     "cwe_refs": [
       "CWE-284"
@@ -91137,7 +91210,8 @@
     "_kev_short_description": "Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the access-control bypass, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99094
   },
   "CVE-2026-20253": {
     "name": "Splunk Enterprise Missing Authentication for Critical Function Vulnerability",
@@ -91200,9 +91274,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.921,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.96939,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.96939 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20253",
     "cwe_refs": [
       "CWE-306"
@@ -91244,7 +91318,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the missing authentication for a critical function, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the missing authentication for a critical function, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99884
   },
   "CVE-2026-48907": {
     "name": "Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
@@ -91309,7 +91384,7 @@
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.55914,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.55914 (99th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48907",
     "cwe_refs": [
       "CWE-284"
@@ -91352,7 +91427,8 @@
     "_kev_short_description": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. ",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the editor access-control bypass enabling webshell upload, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.98948
   },
   "CVE-2026-54420": {
     "name": "LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability",
@@ -91413,9 +91489,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.01261,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01439,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01439 (71st percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-54420",
     "cwe_refs": [
       "CWE-61"
@@ -91457,7 +91533,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the symlink-following cross-account file access, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the symlink-following cross-account file access, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.70652
   },
   "CVE-2026-20262": {
     "name": "Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
@@ -91523,7 +91600,7 @@
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.28171,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.28171 (98th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20262",
     "cwe_refs": [
       "CWE-22"
@@ -91566,7 +91643,8 @@
     "_kev_short_description": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the path traversal, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.97923
   },
   "CVE-2025-34028": {
     "name": "Commvault Command Center Path Traversal Vulnerability",
@@ -91628,9 +91706,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.97157,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.97657,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.97657 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-34028",
     "cwe_refs": [
       "CWE-22",
@@ -91673,7 +91751,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path-traversal to RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path-traversal to RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99897
   },
   "CVE-2024-58136": {
     "name": "Yiiframework Yii Improper Protection of Alternate Path Vulnerability",
@@ -91734,9 +91813,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.87714,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.84758,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.84758 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-58136",
     "cwe_refs": [
       "CWE-424"
@@ -91778,7 +91857,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the alternate-path protection bypass to RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the alternate-path protection bypass to RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99687
   },
   "CVE-2024-38475": {
     "name": "Apache HTTP Server Improper Escaping of Output Vulnerability",
@@ -91841,7 +91921,7 @@
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.99957,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.99957 (100th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-38475",
     "cwe_refs": [
       "CWE-116"
@@ -91884,7 +91964,8 @@
     "_kev_short_description": "Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99975
   },
   "CVE-2023-44221": {
     "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
@@ -91945,9 +92026,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.7493,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.74933,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.74933 (99th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-44221",
     "cwe_refs": [
       "CWE-78"
@@ -91989,7 +92070,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99458
   },
   "CVE-2025-1976": {
     "name": "Broadcom Brocade Fabric OS Code Injection Vulnerability",
@@ -92050,9 +92132,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.00736,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.00784,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.00784 (53rd percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-1976",
     "cwe_refs": [
       "CWE-94",
@@ -92095,7 +92177,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the authenticated code injection to root, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the authenticated code injection to root, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.52636
   },
   "CVE-2025-42599": {
     "name": "Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability",
@@ -92154,9 +92237,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.0302,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.03215,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.03215 (87th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-42599",
     "cwe_refs": [
       "CWE-121"
@@ -92198,7 +92281,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated stack buffer overflow RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated stack buffer overflow RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.86999
   },
   "CVE-2025-3928": {
     "name": "Commvault Web Server Unspecified Vulnerability",
@@ -92259,9 +92343,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.019,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.02089,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.02089 (80th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-3928",
     "cwe_refs": [
       "CWE-434"
@@ -92303,7 +92387,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the webshell creation on the web server, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the webshell creation on the web server, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.79813
   },
   "CVE-2025-24054": {
     "name": "Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability",
@@ -92372,7 +92457,7 @@
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.58616,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.58616 (99th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24054",
     "cwe_refs": [
       "CWE-73"
@@ -92415,7 +92500,8 @@
     "_kev_short_description": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the NTLM hash disclosure via crafted .library-ms files, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.99012
   },
   "CVE-2025-31201": {
     "name": "Apple Multiple Products Arbitrary Read and Write Vulnerability",
@@ -92476,9 +92562,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.1236,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.14652,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.14652 (96th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31201",
     "cwe_refs": [
       "CWE-1220"
@@ -92520,7 +92606,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the pointer-authentication (RPAC) bypass giving arbitrary read/write, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the pointer-authentication (RPAC) bypass giving arbitrary read/write, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.96326
   },
   "CVE-2025-31200": {
     "name": "Apple Multiple Products Memory Corruption Vulnerability",
@@ -92582,9 +92669,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.21255,
-    "epss_date": "2026-06-26",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.1966,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.1966 (97th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-31200",
     "cwe_refs": [
       "CWE-119"
@@ -92626,7 +92713,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the CoreAudio memory-corruption RCE via a crafted media file, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the CoreAudio memory-corruption RCE via a crafted media file, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.97135
   },
   "CVE-2021-20035": {
     "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
@@ -92688,9 +92776,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.0389,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.04181,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.04181 (90th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-20035",
     "cwe_refs": [
       "CWE-78"
@@ -92732,7 +92820,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authenticated OS command injection driven to code execution, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authenticated OS command injection driven to code execution, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.89959
   },
   "CVE-2024-53150": {
     "name": "Linux Kernel Out-of-Bounds Read Vulnerability",
@@ -92797,9 +92886,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.01325,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01351,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01351 (69th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-53150",
     "cwe_refs": [
       "CWE-125"
@@ -92841,7 +92930,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel read, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel read, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.68889
   },
   "CVE-2024-53197": {
     "name": "Linux Kernel Out-of-Bounds Access Vulnerability",
@@ -92907,9 +92997,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.0356,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.03558,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.03558 (88th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-53197",
     "cwe_refs": [
       "CWE-787"
@@ -92951,7 +93041,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel access, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel access, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.88216
   },
   "CVE-2025-29824": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
@@ -93013,9 +93104,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.17982,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.13475,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.13475 (96th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-29824",
     "cwe_refs": [
       "CWE-416"
@@ -93057,7 +93148,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the CLFS driver use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the CLFS driver use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.96071
   },
   "CVE-2025-30406": {
     "name": "Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability",
@@ -93117,9 +93209,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.92727,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.93842,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.93842 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-30406",
     "cwe_refs": [
       "CWE-321",
@@ -93162,7 +93254,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the hard-coded machineKey enabling ViewState deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the hard-coded machineKey enabling ViewState deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99835
   },
   "CVE-2025-24813": {
     "name": "Apache Tomcat Path Equivalence Vulnerability",
@@ -93225,9 +93318,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.99945,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.99925,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.99925 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24813",
     "cwe_refs": [
       "CWE-44",
@@ -93271,7 +93364,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the path-equivalence partial-PUT deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the path-equivalence partial-PUT deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99968
   },
   "CVE-2024-20439": {
     "name": "Cisco Smart Licensing Utility Static Credential Vulnerability",
@@ -93332,9 +93426,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.9201,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.92062,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.92062 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-20439",
     "cwe_refs": [
       "CWE-798",
@@ -93377,7 +93471,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the undocumented static administrative credential, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the undocumented static administrative credential, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99811
   },
   "CVE-2025-2783": {
     "name": "Google Chromium Mojo Sandbox Escape Vulnerability",
@@ -93437,8 +93532,8 @@
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.08404,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.08404 (94th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-2783",
     "cwe_refs": [
       "CWE-501"
@@ -93480,7 +93575,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS retained; CWE assigned editorially (NVD lists none for this entry), ATT&CK + IOCs derived from the Mojo IPC sandbox escape via an incorrectly-provided handle, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS retained; CWE assigned editorially (NVD lists none for this entry), ATT&CK + IOCs derived from the Mojo IPC sandbox escape via an incorrectly-provided handle, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.94445
   },
   "CVE-2019-9875": {
     "name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (post-authentication)",
@@ -93540,9 +93636,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.142,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.14154,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.14154 (96th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-9875",
     "cwe_refs": [
       "CWE-502"
@@ -93584,7 +93680,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the post-authentication deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the post-authentication deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.96222
   },
   "CVE-2019-9874": {
     "name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (unauthenticated)",
@@ -93645,8 +93742,8 @@
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=18 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.83857,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.83857 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2019-9874",
     "cwe_refs": [
       "CWE-502"
@@ -93688,7 +93785,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99666
   },
   "CVE-2017-12637": {
     "name": "SAP NetWeaver Directory Traversal Vulnerability",
@@ -93749,9 +93847,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.94557,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.95111,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.95111 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2017-12637",
     "cwe_refs": [
       "CWE-22"
@@ -93793,7 +93891,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the directory-traversal arbitrary file disclosure, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the directory-traversal arbitrary file disclosure, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99855
   },
   "CVE-2024-48248": {
     "name": "NAKIVO Backup and Replication Absolute Path Traversal Vulnerability",
@@ -93853,9 +93952,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.93995,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.94265,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.94265 (100th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-48248",
     "cwe_refs": [
       "CWE-36"
@@ -93897,7 +93996,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated absolute-path arbitrary file read, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated absolute-path arbitrary file read, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99842
   },
   "CVE-2025-1316": {
     "name": "Edimax IC-7100 IP Camera OS Command Injection Vulnerability",
@@ -93958,9 +94058,9 @@
       "reboot_required": 0
     },
     "rwep_notes": "P1 — KEV-listed confirmed exploitation. blast_radius=20 (scoped product surface). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.7227,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.73036,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.73036 (99th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-1316",
     "cwe_refs": [
       "CWE-78"
@@ -94002,7 +94102,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.99403
   },
   "CVE-2025-24472": {
     "name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
@@ -94065,9 +94166,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.02988,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.03342,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.03342 (87th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24472",
     "cwe_refs": [
       "CWE-288"
@@ -94109,7 +94210,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": " Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authentication bypass via a crafted CSF proxy request, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authentication bypass via a crafted CSF proxy request, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.87497
   },
   "CVE-2025-21590": {
     "name": "Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability",
@@ -94176,9 +94278,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.01657,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01715,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01715 (75th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-21590",
     "cwe_refs": [
       "CWE-653"
@@ -94220,7 +94322,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the improper isolation allowing local code injection into Junos, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the improper isolation allowing local code injection into Junos, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.7523
   },
   "CVE-2025-24993": {
     "name": "Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability",
@@ -94286,9 +94389,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=26 (broadly-deployed platform). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.02092,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.02173,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.02173 (81st percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24993",
     "cwe_refs": [
       "CWE-122"
@@ -94330,7 +94433,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS heap-based buffer overflow on mounting a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS heap-based buffer overflow on mounting a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.80584
   },
   "CVE-2025-24991": {
     "name": "Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability",
@@ -94400,9 +94504,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.01852,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01995,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01995 (79th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24991",
     "cwe_refs": [
       "CWE-125"
@@ -94444,7 +94548,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS out-of-bounds read on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS out-of-bounds read on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.78792
   },
   "CVE-2025-24985": {
     "name": "Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability",
@@ -94510,9 +94615,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.03705,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.03846,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.03846 (89th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24985",
     "cwe_refs": [
       "CWE-122",
@@ -94555,7 +94660,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Fast FAT integer overflow leading to a heap overflow on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Fast FAT integer overflow leading to a heap overflow on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.89119
   },
   "CVE-2025-24984": {
     "name": "Microsoft Windows NTFS Information Disclosure Vulnerability",
@@ -94621,7 +94727,7 @@
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=22 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
     "epss_score": 0.01972,
     "epss_date": "2026-08-07",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_note": "FIRST EPSS 0.01972 (79th percentile) as of 2026-08-07.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24984",
     "cwe_refs": [
       "CWE-532"
@@ -94664,7 +94770,8 @@
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS information disclosure via sensitive data written to a log, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-08",
+    "epss_percentile": 0.78521
   },
   "CVE-2025-24983": {
     "name": "Microsoft Windows Win32k Use-After-Free Vulnerability",
@@ -94726,9 +94833,9 @@
       "reboot_required": 5
     },
     "rwep_notes": "P2 — KEV-listed confirmed exploitation. blast_radius=24 (widely-deployed product/appliance). Score = KEV+PoC+active-exploitation contributions, patch offset, reboot premium.",
-    "epss_score": 0.01267,
-    "epss_date": "2026-06-28",
-    "epss_note": "EPSS pulled from FIRST.org at curation time.",
+    "epss_score": 0.01348,
+    "epss_date": "2026-08-08",
+    "epss_note": "FIRST EPSS 0.01348 (69th percentile) as of 2026-08-08.",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-24983",
     "cwe_refs": [
       "CWE-416"
@@ -94770,7 +94877,8 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Win32k use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Win32k use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "epss_percentile": 0.68811
   },
   "CVE-2026-60137": {
     "name": "WordPress Core SQL Injection Vulnerability",
@@ -94787,7 +94895,7 @@
     "complexity": "high",
     "vector": "WordPress Core mishandles the author__not_in parameter of WP_Query, allowing SQL injection when untrusted input reaches the parameter; chained with CVE-2026-63030 for unauthenticated remote code execution.",
     "epss_score": 0.79029,
-    "epss_percentile": 0.97219,
+    "epss_percentile": 0.9956,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-60137",
     "vendor_advisories": [
@@ -94885,7 +94993,7 @@
     "complexity": "low",
     "vector": "WordPress Core REST API batch endpoint (/wp-json/batch/v1) has an array-desynchronization interpretation conflict that misroutes handler dispatch, letting an unauthenticated attacker bypass validation to perform SQL injection and achieve remote code execution; chained with CVE-2026-60137.",
     "epss_score": 0.98417,
-    "epss_percentile": 0.98425,
+    "epss_percentile": 0.99915,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-63030",
     "vendor_advisories": [
@@ -95088,7 +95196,7 @@
     "complexity": "high",
     "vector": "DD-WRT UPnP/SSDP handler (ssdp.c, ssdp_msearch) performs an unbounded strcpy of a user-supplied oversized ST-header value into a fixed 128-byte stack buffer, allowing an unauthenticated attacker to overflow the buffer and achieve code execution.",
     "epss_score": 0.16488,
-    "epss_percentile": 0.95377,
+    "epss_percentile": 0.9668,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-27137",
     "vendor_advisories": [
@@ -95192,7 +95300,7 @@
     "active_exploitation": "confirmed",
     "complexity": "high",
     "vector": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.",
-    "epss_score": 0.0027,
+    "epss_score": 0.00492,
     "epss_percentile": 0.39697,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-18556",
@@ -95233,7 +95341,7 @@
       "N-central 2026.2 (2026-04-28) closed the originally-reported path but left the alternate channel open — tracked separately as CVE-2026-18577 and exploitable through 2026.3.1",
       "Both N-able-hosted (cloud) and on-premises N-central deployments"
     ],
-    "complexity_notes": "Both scoring vectors carry AC:H — the CNA's CVSS 4.0 (8.2, AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and NVD's own CVSS 3.1 (7.4, AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N). That high-complexity rating reflects the alternate channel being undocumented and unexploited publicly, not any difficulty once the request is known; N-able's decision to withhold root cause is doing the work the AC metric is credited for. Every other signal contradicts it: CISA's SSVC decision recorded on 2026-08-04 marks exploitation \"active\", the KEV remediation window is three days under BOD 26-04, and N-able confirmed customer environments were compromised. The EPSS value of 0.0027 (19th percentile) should be discarded outright for prioritisation here — EPSS is driven by observed public exploit circulation, and because no PoC exists it scores an actively-exploited RMM takeover below the corpus median. The genuine risk driver is blast radius rather than exploitability: a single console compromise inherits privileged remote access to every endpoint the MSP manages, which is why CISA set a 3-day due date on a CVE whose CVSS is 8.2.",
+    "complexity_notes": "Both scoring vectors carry AC:H — the CNA's CVSS 4.0 (8.2, AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and NVD's own CVSS 3.1 (7.4, AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N). That high-complexity rating reflects the alternate channel being undocumented and unexploited publicly, not any difficulty once the request is known; N-able's decision to withhold root cause is doing the work the AC metric is credited for. Every other signal contradicts it: CISA's SSVC decision recorded on 2026-08-04 marks exploitation \"active\", the KEV remediation window is three days under BOD 26-04, and N-able confirmed customer environments were compromised. The EPSS value of 0.00492 (40th percentile) should be discarded outright for prioritisation here — EPSS is driven by observed public exploit circulation, and because no PoC exists it scores an actively-exploited RMM takeover below the corpus median. The genuine risk driver is blast radius rather than exploitability: a single console compromise inherits privileged remote access to every endpoint the MSP manages, which is why CISA set a 3-day due date on a CVE whose CVSS is 8.2.",
     "patch_available": true,
     "patch_required_reboot": false,
     "live_patch_available": false,
@@ -95299,7 +95407,7 @@
     "complexity": "low",
     "vector": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
     "epss_score": 0.8116,
-    "epss_percentile": 0.9858,
+    "epss_percentile": 0.99598,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-34486",
     "vendor_advisories": [
@@ -95504,7 +95612,7 @@
     "active_exploitation": "confirmed",
     "complexity": "high",
     "vector": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
-    "epss_score": 0.02529,
+    "epss_score": 0.04103,
     "epss_percentile": 0.89781,
     "epss_date": "2026-08-07",
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-18577",
@@ -95538,7 +95646,7 @@
       "Fixed only in N-central 2026.3.1 Hotfix 1 (2026.3.1.7), released 2026-08-02",
       "Both N-able-hosted (cloud) and on-premises N-central deployments"
     ],
-    "complexity_notes": "AC:H in both vectors (CNA CVSS 4.0 8.2, NVD CVSS 3.1 8.1) is doing the same misleading work as on CVE-2026-18556 — it prices in the fact that the alternate channel is undocumented and unpublished, not that exploitation is operationally difficult. The same record carries E:A (exploit maturity ATTACKED) in the CVSS 4.0 vector, which is the more decision-relevant field: a vector that says \"high complexity\" and \"currently being attacked\" simultaneously means the complexity is knowledge-gated, and the knowledge is already in attacker hands. Distinguishing signals from the parent CVE: the CVSS 4.0 subsequent-system metrics move from SC:N/SI:N/SA:N on CVE-2026-18556 to SC:L/SI:L/SA:L here, correctly recognising that compromise propagates beyond the console into managed estates; the CVSS 3.1 availability impact rises from A:N to A:H; the KEV due date is a day earlier (2026-08-06 versus 2026-08-07) despite the later CVE number, because CISA listed this one first on 2026-08-03; and EPSS is roughly ten times the parent's at 0.025 (83rd percentile) — still far too low for a KEV-listed RMM takeover with confirmed compromises, since EPSS keys off public exploit circulation and none exists. The defining characteristic for triage is that this is an incomplete-patch bypass: any prioritisation model that credits \"patched\" as a risk reduction scored these environments as remediated for the three months they were exposed.",
+    "complexity_notes": "AC:H in both vectors (CNA CVSS 4.0 8.2, NVD CVSS 3.1 8.1) is doing the same misleading work as on CVE-2026-18556 — it prices in the fact that the alternate channel is undocumented and unpublished, not that exploitation is operationally difficult. The same record carries E:A (exploit maturity ATTACKED) in the CVSS 4.0 vector, which is the more decision-relevant field: a vector that says \"high complexity\" and \"currently being attacked\" simultaneously means the complexity is knowledge-gated, and the knowledge is already in attacker hands. Distinguishing signals from the parent CVE: the CVSS 4.0 subsequent-system metrics move from SC:N/SI:N/SA:N on CVE-2026-18556 to SC:L/SI:L/SA:L here, correctly recognising that compromise propagates beyond the console into managed estates; the CVSS 3.1 availability impact rises from A:N to A:H; the KEV due date is a day earlier (2026-08-06 versus 2026-08-07) despite the later CVE number, because CISA listed this one first on 2026-08-03; and EPSS is roughly eight times the parent's at 0.04103 (90th percentile) — still far too low for a KEV-listed RMM takeover with confirmed compromises, since EPSS keys off public exploit circulation and none exists. The defining characteristic for triage is that this is an incomplete-patch bypass: any prioritisation model that credits \"patched\" as a risk reduction scored these environments as remediated for the three months they were exposed.",
     "patch_available": true,
     "patch_required_reboot": false,
     "live_patch_available": false,