@blamejs/exceptd-skills 0.19.31 → 0.19.32

package/data/cve-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-08-19",
+    "last_updated": "2026-08-22",
     "source": "NVD + CISA KEV + vendor advisories — see sources/index.json",
     "required_fields": [
       "type",
@@ -9501,7 +9501,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2022-03-15",
     "cisa_kev_due_date": "2022-04-05",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A stack buffer overflow in SonicWall SonicOS is reachable by an unauthenticated remote attacker sending a crafted HTTP request to the firewall's HTTP/HTTPS management interface or SSL VPN portal. The overflow reliably causes a denial of service by crashing the affected service and, per the vendor and NVD, can potentially be leveraged for arbitrary code execution. It affects the SonicOS HTTP request-handling path exposed on the device's web/VPN front end, so no credentials or user interaction are needed.",
@@ -9547,7 +9547,7 @@
     "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-5135 (CWE-120, CVSS 9.8) + CISA KEV (added 2022-03-15) + SonicWall advisory SNWLID-2020-0010, with affected versions taken from the SonicWall CNA record in CVEProject/cvelistV5. Neither that record nor the PSIRT page yields a reporter credit.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added CVE-2020-5135 to KEV on 2022-03-15; that listing is CISA's evidence of in-the-wild use. The KEV record carries no ransomware association (known_ransomware_use false). EPSS is 0.24563 (97.7th percentile), consistent with a flaw whose reliable outcome is DoS and whose RCE remains difficult. The KEV record names no campaign and no actor.",
+    "active_exploitation_notes": "CISA added CVE-2020-5135 to KEV on 2022-03-15; that listing is CISA's evidence of in-the-wild use. The KEV record marks ransomware campaign use as Known. EPSS is 0.24563 (97.7th percentile), consistent with a flaw whose reliable outcome is DoS and whose RCE remains difficult. The KEV record names no campaign and no actor.",
     "attack_refs": [
       "T1190",
       "T1499.004"
@@ -9591,7 +9591,8 @@
       "reboot_required": 5
     },
     "rwep_score": 59,
-    "rwep_notes": "RWEP 59. cisa_kev +25, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 59. cisa_kev +25, active_exploitation +20, blast_radius +24, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-5410": {
     "name": "VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability",
@@ -31512,7 +31513,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2022-06-27",
     "cisa_kev_due_date": "2022-07-18",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "polkit's pkexec is a setuid-root helper. When invoked with an empty argument vector (argc==0), its argument-processing loop reads and writes one element past the bounds of the argv/envp arrays, letting the process re-introduce an attacker-controlled environment variable that pkexec normally strips. By crafting GCONV_PATH (and a matching malicious gconv module) into that re-injected environment, an unprivileged local user induces pkexec to load and execute the attacker's shared object as root — a reliable local privilege escalation to full root, exploitable with no authentication prompt.",
@@ -31600,7 +31601,8 @@
       "reboot_required": 0
     },
     "rwep_score": 74,
-    "rwep_notes": "RWEP 74. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 74. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +24, patch_available -15. Σ factors === rwep_score.",
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-22047": {
     "name": "Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability",
@@ -54490,7 +54492,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2026-07-14",
     "cisa_kev_due_date": "2026-07-17",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.",
@@ -54534,7 +54536,7 @@
     "ai_discovery_source": "vendor_research",
     "discovery_attribution_note": "Curated from NVD CVE-2026-15409 (CWE-918, CVSS 10.0) + CISA KEV (added 2026-07-14) + SonicWall PSIRT advisory SNWLID-2026-0008.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "Added to CISA KEV 2026-07-14 under BOD 26-04 with a 3-day due date, indicating observed in-the-wild abuse against internet-facing SonicWall SMA1000 remote-access appliances. Ransomware use not confirmed.",
+    "active_exploitation_notes": "Added to CISA KEV 2026-07-14 under BOD 26-04 with a 3-day due date, indicating observed in-the-wild abuse against internet-facing SonicWall SMA1000 remote-access appliances. CISA's record marks ransomware campaign use as Known, without naming a campaign or an operator.",
     "attack_refs": [
       "T1190"
     ],
@@ -54570,7 +54572,7 @@
     },
     "rwep_score": 61,
     "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-15410": {
     "name": "SonicWall SMA1000 Appliances Code Injection Vulnerability",
@@ -54582,7 +54584,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2026-07-14",
     "cisa_kev_due_date": "2026-07-17",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.",
@@ -54623,7 +54625,7 @@
     "ai_discovery_source": "vendor_research",
     "discovery_attribution_note": "Curated from NVD CVE-2026-15410 (CWE-94, CVSS 7.2) + CISA KEV (added 2026-07-14) + SonicWall PSIRT advisory SNWLID-2026-0008.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added it to KEV on 2026-07-14 with a 3-day due date, signalling observed in-the-wild abuse of SMA1000 SSL-VPN appliances; ransomware association is unconfirmed. Exploitation requires an authenticated administrator session on the Appliance Management Console.",
+    "active_exploitation_notes": "CISA added it to KEV on 2026-07-14 with a 3-day due date, signalling observed in-the-wild abuse of SMA1000 SSL-VPN appliances, and marks ransomware campaign use as Known without naming a campaign or an operator. Exploitation requires an authenticated administrator session on the Appliance Management Console.",
     "attack_refs": [
       "T1190",
       "T1059"
@@ -54660,7 +54662,7 @@
     },
     "rwep_score": 56,
     "rwep_notes": "RWEP 56. cisa_kev +25, active_exploitation +20, blast_radius +21, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-22"
   },
   "CVE-2008-4128": {
     "name": "Cisco IOS Cross-Site Request Forgery Vulnerability",
@@ -54961,7 +54963,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2024-09-18",
     "cisa_kev_due_date": "2024-10-09",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.",
@@ -55005,7 +55007,7 @@
     "ai_discovery_source": "vendor_research",
     "discovery_attribution_note": "Curated from NVD CVE-2020-0618 (CWE-502, CVSS 8.8) + CISA KEV (added 2024-09-18) + Microsoft MSRC advisory CVE-2020-0618.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "Actively exploited against internet-exposed SQL Server Reporting Services instances; a low-privileged authenticated user posts a crafted __VIEWSTATE to a report page to run code as the Report Server service account. Ransomware use unconfirmed by CISA but the flaw is a common ransomware-adjacent foothold on exposed BI servers.",
+    "active_exploitation_notes": "Actively exploited against internet-exposed SQL Server Reporting Services instances; a low-privileged authenticated user posts a crafted __VIEWSTATE to a report page to run code as the Report Server service account. CISA's record marks ransomware campaign use as Known; the flaw is a foothold on exposed BI servers rather than the encryption stage itself.",
     "attack_refs": [
       "T1190",
       "T1059"
@@ -55043,7 +55045,8 @@
       "reboot_required": 5
     },
     "rwep_score": 77,
-    "rwep_notes": "RWEP 77. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 77. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-27348": {
     "name": "Apache HugeGraph-Server Improper Access Control Vulnerability",
@@ -59388,7 +59391,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2024-07-09",
     "cisa_kev_due_date": "2024-07-30",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.",
@@ -59467,7 +59470,8 @@
       "reboot_required": 0
     },
     "rwep_score": 81,
-    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +16. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +16. Σ factors === rwep_score.",
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-38080": {
     "name": "Microsoft Windows Hyper-V Privilege Escalation Vulnerability",
@@ -65093,7 +65097,7 @@
     "cisa_kev": true,
     "cisa_kev_date": "2025-02-06",
     "cisa_kev_due_date": "2025-02-27",
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "active_exploitation": "confirmed",
     "complexity": "low",
     "vector": "An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.",
@@ -65138,7 +65142,7 @@
     "ai_discovery_source": "vendor_research",
     "discovery_attribution_note": "Curated from NVD CVE-2020-29574 (CWE-89, CVSS 9.8) + CISA KEV (added 2025-02-06) + Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqli (2020-12-10).",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "Listed in CISA KEV confirming active in-the-wild exploitation of unauthenticated SQL injection against the CyberoamOS WebAdmin interface; on some compromised systems this was used to create unrecognized administrative accounts. Ransomware association is not confirmed (KEV flags ransomware use as Unknown), and the product is now end-of-life/end-of-service per CISA's required action.",
+    "active_exploitation_notes": "Listed in CISA KEV confirming active in-the-wild exploitation of unauthenticated SQL injection against the CyberoamOS WebAdmin interface; on some compromised systems this was used to create unrecognized administrative accounts. CISA's record marks ransomware campaign use as Known, and the product is end-of-life/end-of-service per CISA's required action.",
     "attack_refs": [
       "T1190",
       "T1078"
@@ -65174,7 +65178,8 @@
       "reboot_required": 5
     },
     "rwep_score": 73,
-    "rwep_notes": "RWEP 73. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +18, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+    "rwep_notes": "RWEP 73. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +18, patch_available -15, reboot_required +5. Σ factors === rwep_score.",
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-15069": {
     "name": "Sophos XG Firewall Buffer Overflow Vulnerability",
@@ -72648,7 +72653,7 @@
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
-    "active_exploitation_notes": "CISA added this SharePoint deserialization RCE to the KEV catalog on 2026-07-01 citing confirmed active exploitation, notable because Microsoft's own advisory had rated exploitation 'Less Likely.' As of the KEV listing, public reporting states it is not yet known who is behind the activity, how the flaw is being weaponized in the wild, or the end objective; no threat actor, ransomware crew, or campaign has been publicly attributed. Exploitation requires an authenticated account with at least Site Member permissions, so observed activity likely leverages stolen/low-privilege SharePoint credentials to reach the deserialization sink. FCEB remediation was due 2026-07-04.",
+    "active_exploitation_notes": "CISA added this SharePoint deserialization RCE to the KEV catalog on 2026-07-01 citing confirmed active exploitation, notable because Microsoft's own advisory had rated exploitation 'Less Likely.' As of the KEV listing, public reporting states it is not yet known who is behind the activity, how the flaw is being weaponized in the wild, or the end objective; no threat actor, ransomware crew, or campaign has been publicly attributed, though CISA's record marks ransomware campaign use as Known. Exploitation requires an authenticated account with at least Site Member permissions, so observed activity likely leverages stolen/low-privilege SharePoint credentials to reach the deserialization sink. FCEB remediation was due 2026-07-04.",
     "affected": "Microsoft SharePoint Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
     "affected_versions": [
       "SharePoint Server Subscription Edition",
@@ -72734,8 +72739,9 @@
     "_kev_short_description": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.94809
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.94809,
+    "known_ransomware_use": true
   },
   "CVE-2026-48558": {
     "name": "SimpleHelp Authentication Bypass Vulnerability",
@@ -72840,8 +72846,9 @@
     "_kev_short_description": "SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 10 and CWE(s) CWE-347 retained; ATT&CK + IOCs derived from the Auth-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.95595
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.95595,
+    "known_ransomware_use": false
   },
   "CVE-2025-26633": {
     "name": "Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability",
@@ -72954,7 +72961,9 @@
     "_kev_short_description": "Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7 and CWE(s) CWE-707 retained; ATT&CK + IOCs derived from the Security-Feature-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.98055
+    "epss_percentile": 0.98055,
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-13161": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForSingleFile)",
@@ -73066,7 +73075,9 @@
     "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.99779
+    "epss_percentile": 0.99779,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-13160": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcard)",
@@ -73178,7 +73189,9 @@
     "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.99798
+    "epss_percentile": 0.99798,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-13159": {
     "name": "Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability (GetHashForWildcardRecursive)",
@@ -73290,7 +73303,9 @@
     "_kev_short_description": "Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-36 retained; ATT&CK + IOCs derived from the Credential-Coercion mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.9996
+    "epss_percentile": 0.9996,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-57968": {
     "name": "Advantive VeraCore Unrestricted File Upload Vulnerability",
@@ -73393,7 +73408,9 @@
     "_kev_short_description": "Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.9 and CWE(s) CWE-434 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.98173
+    "epss_percentile": 0.98173,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-25181": {
     "name": " Advantive VeraCore SQL Injection Vulnerability",
@@ -73503,7 +73520,9 @@
     "_kev_short_description": "Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.8 and CWE(s) CWE-89 retained; ATT&CK + IOCs derived from the SQL-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.98819
+    "epss_percentile": 0.98819,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-50302": {
     "name": "Linux Kernel Use of Uninitialized Resource Vulnerability",
@@ -73606,7 +73625,9 @@
     "_kev_short_description": "The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 5.5 and CWE(s) CWE-908 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.53493
+    "epss_percentile": 0.53493,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-4885": {
     "name": "Progress WhatsUp Gold Path Traversal Vulnerability",
@@ -73713,7 +73734,9 @@
     "_kev_short_description": "Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-22 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.99932
+    "epss_percentile": 0.99932,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2018-8639": {
     "name": "Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability",
@@ -73821,7 +73844,9 @@
     "_kev_short_description": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 7.8 and CWE(s) CWE-404 retained; ATT&CK + IOCs derived from the LPE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.97458
+    "epss_percentile": 0.97458,
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-43769": {
     "name": "Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability",
@@ -73931,7 +73956,9 @@
     "_kev_short_description": "Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-74/CWE-94 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.99898
+    "epss_percentile": 0.99898,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-43939": {
     "name": "Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability",
@@ -74037,7 +74064,9 @@
     "_kev_short_description": "Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.6 and CWE(s) CWE-647 retained; ATT&CK + IOCs derived from the Authorization-Bypass mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.99814
+    "epss_percentile": 0.99814,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-20118": {
     "name": "Cisco Small Business RV Series Routers Command Injection Vulnerability",
@@ -74147,7 +74176,9 @@
     "_kev_short_description": "Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-77 retained; ATT&CK + IOCs derived from the Command-Injection mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.98908
+    "epss_percentile": 0.98908,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-34192": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability",
@@ -74249,7 +74280,9 @@
     "_kev_short_description": "Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9 and CWE(s) CWE-79 retained; ATT&CK + IOCs derived from the XSS mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.9951
+    "epss_percentile": 0.9951,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-49035": {
     "name": "Microsoft Partner Center Improper Access Control Vulnerability",
@@ -74351,7 +74384,9 @@
     "_kev_short_description": "Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.7 and CWE(s) CWE-269 retained; ATT&CK + IOCs derived from the Privilege-Escalation mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.68604
+    "epss_percentile": 0.68604,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-20953": {
     "name": "Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability",
@@ -74453,7 +74488,9 @@
     "_kev_short_description": "Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.87721
+    "epss_percentile": 0.87721,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2017-3066": {
     "name": "Adobe ColdFusion Deserialization Vulnerability",
@@ -74561,7 +74598,9 @@
     "_kev_short_description": "Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 9.8 and CWE(s) CWE-502 retained; ATT&CK + IOCs derived from the RCE mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.99792
+    "epss_percentile": 0.99792,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24989": {
     "name": "Microsoft Power Pages Improper Access Control Vulnerability",
@@ -74663,7 +74702,9 @@
     "_kev_short_description": "Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 8.2 and CWE(s) CWE-284 retained; ATT&CK + IOCs derived from the Improper-Access-Control mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=false (in-the-wild / private only); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.75323
+    "epss_percentile": 0.75323,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-0111": {
     "name": "Palo Alto Networks PAN-OS File Read Vulnerability",
@@ -74779,7 +74820,9 @@
     "_kev_short_description": "Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-07-03: NVD CVSS 6.5 and CWE(s) CWE-73/CWE-610 retained; ATT&CK + IOCs derived from the Information-Disclosure mechanism, framework gaps mapped global-first (EU/UK/AU/ISO/NIST), and a paired zero-day lesson added. poc_available=true (public reproducer cited); active_exploitation=confirmed (KEV).",
-    "epss_percentile": 0.78015
+    "epss_percentile": 0.78015,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-23812": {
     "name": "node-ipc geo-targeted file-wiper protestware (RU/BY heart-emoji overwrite; peacenotwar dropper in 11.0.0+)",
@@ -75376,8 +75419,10 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121), zero-day exploited by a China-nexus cluster with the SPAWN malware ecosystem; patch to 22.7R2.5 and rebuild on any ICT compromise indicator.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99979
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99979,
+    "cisa_kev_due_date": "2025-01-15",
+    "known_ransomware_use": true
   },
   "CVE-2025-22457": {
     "ai_assisted_weaponization": false,
@@ -75485,8 +75530,10 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ivanti Connect Secure stack-overflow preauth RCE (CWE-121) initially mis-triaged as DoS then weaponized; patch to 22.7R2.6 and rebuild on compromise indicators.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99985
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99985,
+    "cisa_kev_due_date": "2025-04-11",
+    "known_ransomware_use": true
   },
   "CVE-2025-31324": {
     "ai_assisted_weaponization": false,
@@ -75591,8 +75638,10 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "SAP NetWeaver Visual Composer Metadata Uploader missing-authorization file upload (CWE-434) → unauthenticated RCE via JSP webshell; apply SAP Note 3594142 and hunt for webshells.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99941
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99941,
+    "cisa_kev_due_date": "2025-05-20",
+    "known_ransomware_use": true
   },
   "CVE-2025-31161": {
     "ai_assisted_weaponization": false,
@@ -75696,8 +75745,10 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "CrushFTP HTTP authorization-header authentication bypass (CWE-305) → crushadmin takeover; upgrade to 10.8.4/11.3.1 or front with a DMZ proxy.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99974
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99974,
+    "cisa_kev_due_date": "2025-04-28",
+    "known_ransomware_use": true
   },
   "CVE-2025-30066": {
     "name": "tj-actions/changed-files GitHub Action Supply-Chain Compromise (secret exfiltration to workflow logs)",
@@ -75807,8 +75858,10 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "tj-actions/changed-files GitHub Action tags were repointed to malicious code (CWE-506) that dumped CI/CD secrets to publicly readable workflow logs; remediate by pinning actions to commit SHAs and rotating exposed secrets.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99383
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99383,
+    "cisa_kev_due_date": "2025-04-08",
+    "known_ransomware_use": false
   },
   "CVE-2025-30154": {
     "name": "reviewdog/action-setup GitHub Action Supply-Chain Compromise (secret exfiltration to workflow logs)",
@@ -75918,8 +75971,10 @@
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "reviewdog/action-setup@v1 (and five reviewdog actions that include it transitively) was trojaned (CWE-506) to dump secrets to workflow logs; pin actions to commit SHAs and rotate exposed secrets.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.81623
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.81623,
+    "cisa_kev_due_date": "2025-04-14",
+    "known_ransomware_use": false
   },
   "CVE-2026-48027": {
     "name": "Nx Console IDE Extension Supply-Chain Compromise (malicious marketplace version)",
@@ -76029,7 +76084,10 @@
     "discovery_attribution_note": "Manually curated from NVD CVE-2026-48027 (CWE-506, CVSS 3.1 9.8 / CVSS 4.0 9.3) + CISA KEV (added 2026-05-27) + nrwl/nx-console GHSA-c9j4-9m59-847w + StepSecurity analysis. Trojanized Nx Console 18.95.0 published to the VS Code Marketplace and OpenVSX on 2026-05-19; clean at 18.100.0. Shares the developer-tooling supply-chain control surface with the tj-actions (CVE-2025-30066) and reviewdog (CVE-2025-30154) action compromises.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "A malicious Nx Console 18.95.0 was published to the VS Code Marketplace / OpenVSX (CWE-506) and harvested developer credentials; upgrade to 18.100.0 and rotate credentials if the bad version was installed on 2026-05-19."
+    "_kev_short_description": "A malicious Nx Console 18.95.0 was published to the VS Code Marketplace / OpenVSX (CWE-506) and harvested developer credentials; upgrade to 18.100.0 and rotate credentials if the bad version was installed on 2026-05-19.",
+    "cisa_kev_due_date": "2026-06-10",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": true
   },
   "CVE-2025-53773": {
     "name": "GitHub Copilot / VS Code 'YOLO mode' Prompt Injection RCE",
@@ -76420,7 +76478,8 @@
     },
     "last_updated": "2026-05-13",
     "discovery_attribution_note": "AI-surfaced by Theori using Xint Code AI scanner with one operator prompt against the Linux crypto/ subsystem; researcher Taeyang Lee directed the scan. Disclosed 2026-04-29. Source: Theori writeup mirrored at https://xint.io/blog/copy-fail-linux-distributions and Sysdig coverage https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": false
   },
   "CVE-2026-39884": {
     "name": "Flux159 mcp-server-kubernetes Argument Injection via port_forward",
@@ -76530,7 +76589,7 @@
     "cvss_v4_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
     "cisa_kev": true,
     "cisa_kev_date": "2026-05-08",
-    "cisa_kev_due_date": "2026-05-29",
+    "cisa_kev_due_date": "2026-05-11",
     "poc_available": true,
     "poc_description": "GHSA-r75f-5x8p-qvmc documents the sink shape — crafted Authorization header to any LLM API route reaches the vulnerable query through error-handling paths. KEV-listed implies in-wild exploitation evidence.",
     "ai_discovered": false,
@@ -76632,7 +76691,8 @@
     },
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "Tencent YunDing Security Lab is the credited discoverer per the LiteLLM GHSA-r75f-5x8p-qvmc advisory and confirmed by downstream The Hacker News / Tenable / cve.news coverage. Sysdig TRT (Stefano Chierici + Sysdig Sage analysts) published the post-disclosure 36-hour-to-exploitation telemetry; Bishop Fox reproduced the auth-path SQLi sink. All named-human research; no AI-discovery attribution from any of the three teams. Sources: https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc and https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure and https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy.",
-    "last_verified": "2026-08-08"
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": false
   },
   "CVE-2026-43284": {
     "name": "Dirty Frag (ESP/IPsec component)",
@@ -77896,7 +77956,10 @@
       "_ioc_source_note": "Anchored to NVD CVE-2020-10148 and CISA advisory AA20-352A (SolarWinds SUNBURST)."
     },
     "epss_percentile": 0.9981,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-10148"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-10148",
+    "cisa_kev_due_date": "2022-05-03",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": false
   },
   "CVE-2023-3519": {
     "ai_assisted_weaponization": false,
@@ -77988,7 +78051,10 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-3519 and Citrix advisory CTX561482."
     },
     "epss_percentile": 0.99951,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-3519"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-3519",
+    "cisa_kev_due_date": "2023-08-09",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": true
   },
   "CVE-2024-1709": {
     "ai_assisted_weaponization": false,
@@ -78085,7 +78151,10 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-1709 and the ConnectWise ScreenConnect 23.9.8 security bulletin."
     },
     "epss_percentile": 0.99976,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-1709"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-1709",
+    "cisa_kev_due_date": "2024-02-29",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": true
   },
   "CVE-2026-20182": {
     "ai_assisted_weaponization": false,
@@ -78182,9 +78251,11 @@
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2026-20182, CISA KEV, and the Cisco security advisory."
     },
-    "last_verified": "2026-08-08",
+    "last_verified": "2026-08-22",
     "epss_percentile": 0.99787,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20182"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-20182",
+    "cisa_kev_due_date": "2026-05-17",
+    "known_ransomware_use": false
   },
   "CVE-2024-40635": {
     "ai_assisted_weaponization": false,
@@ -78960,7 +79031,7 @@
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
     "cisa_kev": true,
     "cisa_kev_date": "2026-05-06",
-    "cisa_kev_due_date": "2026-05-27",
+    "cisa_kev_due_date": "2026-05-09",
     "poc_available": true,
     "poc_description": "Vendor-confirmed in-wild exploitation of the User-ID Authentication Portal request-parsing path. Public PoC details withheld during the KEV 21-day window; exploitation chain reaches an out-of-bounds write in the authentication-portal handler reachable pre-auth from any host that can reach the portal's HTTPS endpoint, producing unauth root RCE on the firewall control plane.",
     "ai_discovered": false,
@@ -79061,7 +79132,9 @@
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "Internal discovery by Palo Alto Networks PSIRT during proactive authentication-subsystem auditing; vendor advisory published 2026-05-13 alongside CISA KEV listing 2026-05-06. No AI-tool credit. Source: https://security.paloaltonetworks.com/CVE-2026-0300 and https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog.",
     "_editorial_promoted": "2026-05-15",
-    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed.",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": false
   },
   "CVE-2026-39987": {
     "name": "Marimo Python Notebook Pre-Auth WebSocket Terminal RCE",
@@ -79179,7 +79252,9 @@
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "Marimo team's security review of the terminal subsystem prompted by Sysdig honeypot evidence; vendor advisory + Sysdig blog jointly disclosed 2026-04-21 / 2026-04-23. No AI-tool credit for the discovery; the vulnerable component IS an AI/ML developer surface but the bug was found by conventional human review. Source: https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface and https://github.com/marimo-team/marimo/security/advisories.",
     "_editorial_promoted": "2026-05-15",
-    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-6973": {
     "name": "Ivanti EPMM Authenticated-Admin RCE",
@@ -79291,7 +79366,9 @@
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "Internal Ivanti product-security discovery; vendor advisory + CISA KEV listing jointly published 2026-05-07 with a 3-day due date reflecting confirmed in-wild exploitation. No AI-tool credit. Source: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-CVE-2026-6973 and https://www.helpnetsecurity.com/2026/05/08/ivanti-epmm-zero-day-cve-2026-6973/.",
     "_editorial_promoted": "2026-05-15",
-    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-42897": {
     "name": "Microsoft Exchange OWA Stored XSS / Spoofing Zero-Day",
@@ -79300,7 +79377,7 @@
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
     "cisa_kev": true,
     "cisa_kev_date": "2026-05-15",
-    "cisa_kev_due_date": "2026-06-05",
+    "cisa_kev_due_date": "2026-05-29",
     "poc_available": true,
     "poc_description": "Microsoft Security Response Center confirmed in-wild exploitation observed prior to disclosure. The vulnerability is a stored XSS triggered during OWA's web-page generation when rendering attacker-crafted email content; the payload executes in the victim's authenticated OWA session, enabling token theft, mailbox-wide access, and OWA-mediated spoofing of further internal mail. No patch was available at disclosure — Microsoft directed operators to enable the Exchange Emergency Mitigation Service (EEMS) for vendor-pushed mitigation rules.",
     "ai_discovered": false,
@@ -79407,7 +79484,9 @@
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "Microsoft MSRC discovery from in-the-wild exploitation telemetry; disclosed 2026-05-15 with concurrent CISA KEV listing and Exchange Team blog publication. No binary patch at disclosure; mitigation via Exchange Emergency Mitigation Service. No AI-tool credit. Source: https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498 and https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/.",
     "_editorial_promoted": "2026-05-15",
-    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed.",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": false
   },
   "CVE-2026-32202": {
     "name": "Microsoft Windows Shell LNK Mark-of-the-Web Bypass (APT28)",
@@ -79417,7 +79496,7 @@
     "cvss_correction_note": "CVSS 7.5 is an intake-time estimate aligned with Microsoft's typical LNK-MOTW-bypass scoring; refresh once NVD publishes the authoritative vector.",
     "cisa_kev": true,
     "cisa_kev_date": "2026-04-28",
-    "cisa_kev_due_date": "2026-05-19",
+    "cisa_kev_due_date": "2026-05-12",
     "poc_available": true,
     "poc_description": "APT28 (Fancy Bear) in-wild weaponization of crafted LNK files that bypass Windows' Mark-of-the-Web protection. The exploitation chain pairs CVE-2026-32202 with CVE-2026-21513 to convert a downloaded LNK file into a SmartScreen-suppressed execution path. The chain represents an incomplete-patch class — CVE-2026-21510 attempted to close the same MOTW-bypass surface but did so incompletely, enabling the CVE-2026-32202 re-exploit primitive.",
     "ai_discovered": false,
@@ -79523,7 +79602,9 @@
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "APT28 (Fancy Bear) in-the-wild weaponization observed by Microsoft + Help Net Security 2026-04-28; CVE-2026-32202 represents an incomplete-patch re-exploit of CVE-2026-21510 and chains with CVE-2026-21513 in the operational APT28 toolkit. Nation-state tradecraft; no AI-tool credit on either the discovery or weaponization side. Source: https://www.helpnetsecurity.com/2026/04/29/windows-cve-2026-32202-exploited/ and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202.",
     "_editorial_promoted": "2026-05-15",
-    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed.",
+    "last_verified": "2026-08-22",
+    "known_ransomware_use": false
   },
   "CVE-2026-33825": {
     "name": "BlueHammer — Microsoft Defender File-Remediation TOCTOU LPE",
@@ -79641,7 +79722,9 @@
     "last_updated": "2026-05-15",
     "discovery_attribution_note": "Picus Security ('BlueHammer' / RedSun research) published a working PoC before Microsoft released the patch — true zero-day disclosure 2026-04-22; CISA KEV listed same day with a 14-day due date. No AI-tool credit on the discovery; conventional Windows-Defender internals research. Source: https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained and https://www.cisa.gov/known-exploited-vulnerabilities-catalog.",
     "_editorial_promoted": "2026-05-15",
-    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "MAL-2026-NODE-IPC-STEALER": {
     "name": "node-ipc credential-stealer (expired-domain account-recovery compromise)",
@@ -80128,7 +80211,9 @@
         "An internet-facing FortiGate with SSL-VPN enabled on a FortiOS/FortiProxy build below the fixed version."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2024-21762, Fortinet FG-IR-24-015, and the CISA 2025-04 post-exploitation advisory."
-    }
+    },
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-10585": {
     "id": "CVE-2025-10585",
@@ -80206,7 +80291,9 @@
         "Drive-by navigation to a malicious page delivering the V8 exploit as part of a sandbox-escape chain."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-10585 and the Google TAG / Chrome stable-channel security advisory."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-14174": {
     "id": "CVE-2025-14174",
@@ -80371,7 +80458,9 @@
         "Delivery of a malicious link/page to a high-risk user as the chain's entry point."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-43529 and the Apple security update notes."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-4919": {
     "id": "CVE-2025-4919",
@@ -80614,7 +80703,9 @@
         "Indicators of a zero-click spyware chain on a targeted device following inbound media."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-43300 and the Apple security update notes for the in-the-wild ImageIO fix."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-38352": {
     "id": "CVE-2025-38352",
@@ -80697,7 +80788,9 @@
         "Kernel crash/oops signatures referencing posix_cpu_timer on an affected build."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-38352 and the Android Security Bulletin / upstream kernel fix."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-55241": {
     "id": "CVE-2025-55241",
@@ -81597,7 +81690,9 @@
         "An attacker with administrative/root access inside a guest VM as the precondition for the escape (often post-initial-compromise, ransomware operators)."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-22224 and the Broadcom/VMware VMSA security advisory (in-the-wild ESXi escape chain)."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-22225": {
     "id": "CVE-2025-22225",
@@ -81678,7 +81773,9 @@
         "Ransomware-operator activity pivoting from a guest VM to the hypervisor."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-22225 and the Broadcom/VMware VMSA security advisory."
-    }
+    },
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-22226": {
     "id": "CVE-2025-22226",
@@ -81759,7 +81856,9 @@
         "Guest VM with admin access reading host memory via the HGFS path."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2025-22226 and the Broadcom/VMware VMSA security advisory."
-    }
+    },
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "MAL-2024-PYPI-ULTRALYTICS-XMRIG": {
     "id": "MAL-2024-PYPI-ULTRALYTICS-XMRIG",
@@ -83176,7 +83275,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-41940, CISA KEV (added 2026-04-30), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-1708": {
     "name": "ConnectWise ScreenConnect Path Traversal Vulnerability",
@@ -83287,7 +83388,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-1708, CISA KEV (added 2026-04-28), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-29635": {
     "name": "D-Link DIR-823X Command Injection Vulnerability",
@@ -83397,7 +83500,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-29635, CISA KEV (added 2026-04-24), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-7399": {
     "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability",
@@ -83508,7 +83613,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-7399, CISA KEV (added 2026-04-24), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-57728": {
     "name": "SimpleHelp Path Traversal Vulnerability",
@@ -83618,7 +83725,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-57728, CISA KEV (added 2026-04-24), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-57726": {
     "name": "SimpleHelp Missing Authorization Vulnerability",
@@ -83729,7 +83838,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-57726, CISA KEV (added 2026-04-24), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20122": {
     "name": "Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability",
@@ -83841,7 +83952,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20122, CISA KEV (added 2026-04-20), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20133": {
     "name": "Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
@@ -83953,7 +84066,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20133, CISA KEV (added 2026-04-20), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-2749": {
     "name": "Kentico Xperience Path Traversal Vulnerability",
@@ -84064,7 +84179,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-2749, CISA KEV (added 2026-04-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-27351": {
     "name": "PaperCut NG/MF Improper Authentication Vulnerability",
@@ -84175,7 +84292,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-27351, CISA KEV (added 2026-04-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48700": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability",
@@ -84284,7 +84403,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48700, CISA KEV (added 2026-04-20), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20128": {
     "name": "Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability",
@@ -84396,7 +84517,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20128, CISA KEV (added 2026-04-20), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32975": {
     "name": "Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability",
@@ -84506,7 +84629,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32975, CISA KEV (added 2026-04-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-27199": {
     "name": "JetBrains TeamCity Relative Path Traversal Vulnerability",
@@ -84618,7 +84743,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-27199, CISA KEV (added 2026-04-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-34197": {
     "name": "Apache ActiveMQ Improper Input Validation Vulnerability",
@@ -84729,7 +84856,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-34197, CISA KEV (added 2026-04-16), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2009-0238": {
     "name": "Microsoft Office Remote Code Execution",
@@ -84838,7 +84967,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2009-0238, CISA KEV (added 2026-04-14), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-32201": {
     "name": "Microsoft SharePoint Server Improper Input Validation Vulnerability",
@@ -84947,7 +85078,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-32201, CISA KEV (added 2026-04-14), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2012-1854": {
     "name": "Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability",
@@ -85056,7 +85189,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2012-1854, CISA KEV (added 2026-04-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1574.001 DLL hijack) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1574.001 DLL hijack) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-60710": {
     "name": "Microsoft Windows Link Following Vulnerability",
@@ -85164,7 +85299,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-60710, CISA KEV (added 2026-04-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-21529": {
     "name": "Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability",
@@ -85274,7 +85411,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-21529, CISA KEV (added 2026-04-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-36424": {
     "name": "Microsoft Windows Out-of-Bounds Read Vulnerability",
@@ -85383,7 +85522,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-36424, CISA KEV (added 2026-04-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-9715": {
     "name": "Adobe Acrobat Use-After-Free Vulnerability",
@@ -85491,7 +85632,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2020-9715, CISA KEV (added 2026-04-13), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21643": {
     "name": "Fortinet FortiClient EMS SQL Injection Vulnerability",
@@ -85600,7 +85743,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21643, CISA KEV (added 2026-04-13), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-34621": {
     "name": "Adobe Acrobat and Reader Prototype Pollution Vulnerability",
@@ -85709,7 +85854,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-34621, CISA KEV (added 2026-04-13), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-1340": {
     "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability",
@@ -85821,7 +85968,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-1340, CISA KEV (added 2026-04-08), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-35616": {
     "name": "Fortinet FortiClient EMS Improper Access Control Vulnerability",
@@ -85930,7 +86079,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-35616, CISA KEV (added 2026-04-06), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-3502": {
     "name": "TrueConf Client Download of Code Without Integrity Check Vulnerability",
@@ -86040,7 +86191,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-3502, CISA KEV (added 2026-04-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-5281": {
     "name": "Google Dawn Use-After-Free Vulnerability",
@@ -86148,7 +86301,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-5281, CISA KEV (added 2026-04-01), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-3055": {
     "name": "Citrix NetScaler Out-of-Bounds Read Vulnerability",
@@ -86258,7 +86413,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-3055, CISA KEV (added 2026-03-30), and the Citrix security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-53521": {
     "name": "F5 BIG-IP Stack-Based Buffer Overflow Vulnerability",
@@ -86369,7 +86526,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-53521, CISA KEV (added 2026-03-27), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-33634": {
     "name": "Aquasecurity Trivy Embedded Malicious Code Vulnerability",
@@ -86478,7 +86637,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-33634, CISA KEV (added 2026-03-26), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-34291": {
     "name": "Langflow Account Takeover + RCE (CORS / refresh-token chain)",
@@ -86602,7 +86763,9 @@
     "discovery_attribution_note": "Manually curated from NVD + Obsidian Security writeup + CISA KEV (added 2026-05-21) + CrowdSec exploitation telemetry. CWE-346 (Origin Validation / CORS) chained with CWE-352 (CSRF) on the token-refresh endpoint and CWE-942 (permissive cross-domain policy). Postdates the v0.13.17 bulk KEV intake (catalog version 2026.05.15).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Langflow contains an origin validation error vulnerability that could allow account takeover and remote code execution."
+    "_kev_short_description": "Langflow contains an origin validation error vulnerability that could allow account takeover and remote code execution.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-25592": {
     "name": "Microsoft Semantic Kernel SessionsPythonPlugin Path Traversal — Prompt-Injection to Host RCE",
@@ -87832,7 +87995,9 @@
     "discovery_attribution_note": "Manually curated from NVD (CWE-89; NIST CVSS 9.8) + Drupal SA-CORE-2026-004 + the CISA KEV listing (catalog version 2026.05.22, added 2026-05-22, due 2026-05-27). Conventional unauthenticated SQL injection, no AI-discovery attribution.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Drupal core's database abstraction layer fails to neutralize special elements in a PostgreSQL query condition handler reachable via JSON:API, allowing unauthenticated SQL injection; actively exploited (CISA KEV 2026-05-22, due 2026-05-27); fixed in SA-CORE-2026-004 releases."
+    "_kev_short_description": "Drupal core's database abstraction layer fails to neutralize special elements in a PostgreSQL query condition handler reachable via JSON:API, allowing unauthenticated SQL injection; actively exploited (CISA KEV 2026-05-22, due 2026-05-27); fixed in SA-CORE-2026-004 releases.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-23254": {
     "name": "NVIDIA TensorRT-LLM Python Executor Deserialization RCE (ShadowMQ)",
@@ -93180,7 +93345,9 @@
     "discovery_attribution_note": "Manually curated from the GitHub Security Advisory advisory (https://github.com/advisories/GHSA-rvqx-wpfh-mfx7, CWE-94/CWE-306) + NVD + VulnCheck (CNA, CVSS v3.1 9.8) + the CISA KEV listing (added 2025-05-05). Visual LLM app/agent-builder flaw (Langflow); shares the app-builder execution-endpoint control NEW-CTRL-103.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Langflow's /api/v1/validate/code endpoint runs attacker-supplied Python with no authentication (CWE-94/CWE-306), giving unauthenticated RCE; CISA KEV (added 2025-05-05, actively exploited), fixed in 1.3.0."
+    "_kev_short_description": "Langflow's /api/v1/validate/code endpoint runs attacker-supplied Python with no authentication (CWE-94/CWE-306), giving unauthenticated RCE; CISA KEV (added 2025-05-05, actively exploited), fixed in 1.3.0.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-33017": {
     "name": "Langflow Public Flow-Build Endpoint Unauthenticated Remote Code Execution (CISA KEV)",
@@ -93292,7 +93459,9 @@
     "discovery_attribution_note": "Manually curated from the GitHub Security Advisory advisory (https://github.com/advisories/GHSA-vwmf-pq79-vjvx, CWE-94/CWE-95/CWE-306) + NVD (CVSS v3.1 9.8; GitHub CNA CVSS v4.0 9.3) + the CISA KEV listing (added 2026-03-25). Visual LLM app/agent-builder flaw (Langflow); shares the app-builder execution-endpoint control NEW-CTRL-103.",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Langflow's unauthenticated public flow-build endpoint runs flow-supplied Python through an unsandboxed dynamic-execution sink (CWE-94/CWE-95/CWE-306), giving unauthenticated RCE; CISA KEV (added 2026-03-25, actively exploited), fixed in 1.9.0."
+    "_kev_short_description": "Langflow's unauthenticated public flow-build endpoint runs flow-supplied Python through an unsandboxed dynamic-execution sink (CWE-94/CWE-95/CWE-306), giving unauthenticated RCE; CISA KEV (added 2026-03-25, actively exploited), fixed in 1.9.0.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-24590": {
     "name": "ClearML Client SDK Artifact Deserialization Remote Code Execution",
@@ -95689,7 +95858,9 @@
     "discovery_attribution_note": "Manually curated from NVD + Microsoft MSRC ('Exploitation Detected') + CISA KEV (added 2026-05-20, due 2026-06-03) + Help Net Security / The Hacker News coverage (2026-05-21). CWE-59 (link following) in the Malware Protection Engine, which runs as SYSTEM. Postdates the v0.13.17 bulk KEV intake (catalog version 2026.05.15).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Microsoft Defender (Malware Protection Engine) improperly resolves links before file access, allowing local privilege elevation to SYSTEM."
+    "_kev_short_description": "Microsoft Defender (Malware Protection Engine) improperly resolves links before file access, allowing local privilege elevation to SYSTEM.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-34926": {
     "name": "Trend Micro Apex One Directory Traversal → Malicious Agent Code Deployment",
@@ -95800,7 +95971,9 @@
     "discovery_attribution_note": "Manually curated from NVD + CISA KEV (added 2026-05-21, due 2026-06-04). CWE-23 relative path traversal on the Apex One on-premise management server enabling key-table modification and malicious code deployment to managed agents. Postdates the v0.13.17 bulk KEV intake (catalog version 2026.05.15).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Trend Micro Apex One on-premise contains a directory traversal that lets a pre-authenticated local attacker modify a key table to inject malicious code deployed to agents."
+    "_kev_short_description": "Trend Micro Apex One on-premise contains a directory traversal that lets a pre-authenticated local attacker modify a key table to inject malicious code deployed to agents.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-45498": {
     "name": "Microsoft Defender Remote Denial of Service (Antimalware Platform)",
@@ -95912,7 +96085,9 @@
     "discovery_attribution_note": "Manually curated from NVD (CVSS 7.5, CWE-400) + Microsoft MSRC ('Exploitation Detected') + CISA KEV (added 2026-05-20, due 2026-06-03) + Help Net Security / The Hacker News (2026-05-21). Companion to CVE-2026-41091 in the same Defender advisory. Postdates the v0.13.17 bulk KEV intake (catalog version 2026.05.15).",
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
-    "_kev_short_description": "Microsoft Defender contains an uncontrolled-resource-consumption flaw allowing a remote, unauthenticated denial of service that disables endpoint protection."
+    "_kev_short_description": "Microsoft Defender contains an uncontrolled-resource-consumption flaw allowing a remote, unauthenticated denial of service that disables endpoint protection.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2008-4250": {
     "name": "Microsoft Windows Server Service RPC Buffer Overflow (MS08-067)",
@@ -96007,7 +96182,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2008-4250, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2009-1537": {
     "name": "Microsoft DirectShow QuickTime Parsing Memory Corruption",
@@ -96101,7 +96278,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2009-1537, CISA KEV (added 2026-05-20), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2009-3459": {
     "name": "Adobe Acrobat and Reader Heap-Based Buffer Overflow",
@@ -96195,7 +96374,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2009-3459, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2010-0249": {
     "name": "Microsoft Internet Explorer Use-After-Free (Operation Aurora)",
@@ -96289,7 +96470,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2010-0249, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2010-0806": {
     "name": "Microsoft Internet Explorer Use-After-Free (iepeers)",
@@ -96383,7 +96566,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2010-0806, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32432": {
     "name": "Craft CMS Code Injection Vulnerability",
@@ -96494,7 +96679,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32432, CISA KEV (added 2026-03-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-54068": {
     "name": "Laravel Livewire Code Injection Vulnerability",
@@ -96605,7 +96792,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-54068, CISA KEV (added 2026-03-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-43510": {
     "name": "Apple Multiple Products Improper Locking Vulnerability",
@@ -96721,7 +96910,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-43510, CISA KEV (added 2026-03-20), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-43520": {
     "name": "Apple Multiple Products Classic Buffer Overflow Vulnerability",
@@ -96837,7 +97028,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-43520, CISA KEV (added 2026-03-20), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-31277": {
     "name": "Apple Multiple Products Buffer Overflow Vulnerability",
@@ -96950,7 +97143,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-31277, CISA KEV (added 2026-03-20), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20131": {
     "name": "Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability",
@@ -97060,7 +97255,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20131, CISA KEV (added 2026-03-19), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-66376": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability",
@@ -97169,7 +97366,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-66376, CISA KEV (added 2026-03-18), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20963": {
     "name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
@@ -97278,7 +97477,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20963, CISA KEV (added 2026-03-18), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-47813": {
     "name": "Wing FTP Server Information Disclosure Vulnerability",
@@ -97388,7 +97589,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-47813, CISA KEV (added 2026-03-16), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-3910": {
     "name": "Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability",
@@ -97497,7 +97700,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-3910, CISA KEV (added 2026-03-13), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-3909": {
     "name": "Google Skia Out-of-Bounds Write Vulnerability",
@@ -97606,7 +97811,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-3909, CISA KEV (added 2026-03-13), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-68613": {
     "name": "n8n Improper Control of Dynamically-Managed Code Resources Vulnerability",
@@ -97716,7 +97923,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-68613, CISA KEV (added 2026-03-11), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-22054": {
     "name": "Omnissa Workspace ONE Server-Side Request Forgery",
@@ -97825,7 +98034,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-22054, CISA KEV (added 2026-03-09), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-26399": {
     "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
@@ -97936,7 +98147,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-26399, CISA KEV (added 2026-03-09), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-1603": {
     "name": "Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability",
@@ -98046,7 +98259,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-1603, CISA KEV (added 2026-03-09), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2017-7921": {
     "name": "Hikvision Multiple Products Improper Authentication Vulnerability",
@@ -98156,7 +98371,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2017-7921, CISA KEV (added 2026-03-05), and the vendor / CISA ICS advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-22681": {
     "name": "Rockwell Multiple Products Insufficient Protected Credentials Vulnerability",
@@ -98267,7 +98484,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-22681, CISA KEV (added 2026-03-05), and the vendor / CISA ICS advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-43000": {
     "name": "Apple Multiple products Use-After-Free Vulnerability",
@@ -98378,7 +98597,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-43000, CISA KEV (added 2026-03-05), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-30952": {
     "name": "Apple Multiple Products Integer Overflow or Wraparound Vulnerability",
@@ -98491,7 +98712,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-30952, CISA KEV (added 2026-03-05), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-41974": {
     "name": "Apple iOS and iPadOS Use-After-Free Vulnerability",
@@ -98601,7 +98824,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-41974, CISA KEV (added 2026-03-05), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-22719": {
     "name": "Broadcom VMware Aria Operations Command Injection Vulnerability",
@@ -98712,7 +98937,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-22719, CISA KEV (added 2026-03-03), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21385": {
     "name": "Qualcomm Multiple Chipsets Memory Corruption Vulnerability",
@@ -98820,7 +99047,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21385, CISA KEV (added 2026-03-03), and the Qualcomm security bulletin advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-20775": {
     "name": "Cisco SD-WAN Path Traversal Vulnerability",
@@ -98932,7 +99161,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2022-20775, CISA KEV (added 2026-02-25), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20127": {
     "name": "Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
@@ -99044,7 +99275,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20127, CISA KEV (added 2026-02-25), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-25108": {
     "name": "Soliton Systems K.K FileZen OS Command Injection Vulnerability",
@@ -99154,7 +99387,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-25108, CISA KEV (added 2026-02-24), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-49113": {
     "name": "RoundCube Webmail Deserialization of Untrusted Data Vulnerability",
@@ -99266,7 +99501,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-49113, CISA KEV (added 2026-02-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-68461": {
     "name": "RoundCube Webmail Cross-site Scripting Vulnerability",
@@ -99377,7 +99614,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-68461, CISA KEV (added 2026-02-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1539 steal web session cookie) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1539 steal web session cookie) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-22175": {
     "name": "GitLab Server-Side Request Forgery (SSRF) Vulnerability",
@@ -99486,7 +99725,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-22175, CISA KEV (added 2026-02-18), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-22769": {
     "name": "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability",
@@ -99598,7 +99839,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-22769, CISA KEV (added 2026-02-18), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-7796": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability",
@@ -99707,7 +99950,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2020-7796, CISA KEV (added 2026-02-17), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-7694": {
     "name": "TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -99818,7 +100063,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-7694, CISA KEV (added 2026-02-17), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1505.003 web shell) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1505.003 web shell) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2008-0015": {
     "name": " Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability",
@@ -99927,7 +100174,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2008-0015, CISA KEV (added 2026-02-17), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-2441": {
     "name": "Google Chromium CSS Use-After-Free Vulnerability",
@@ -100035,7 +100284,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-2441, CISA KEV (added 2026-02-17), and the Google Chrome/Chromium security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-1731": {
     "name": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability",
@@ -100146,7 +100397,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-1731, CISA KEV (added 2026-02-13), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20700": {
     "name": "Apple Multiple Buffer Overflow Vulnerability",
@@ -100259,7 +100512,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20700, CISA KEV (added 2026-02-12), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-43468": {
     "name": "Microsoft Configuration Manager SQL Injection Vulnerability",
@@ -100368,7 +100623,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-43468, CISA KEV (added 2026-02-12), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-15556": {
     "name": "Notepad++ Download of Code Without Integrity Check Vulnerability",
@@ -100478,7 +100735,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-15556, CISA KEV (added 2026-02-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-40536": {
     "name": "SolarWinds Web Help Desk Security Control Bypass Vulnerability",
@@ -100589,7 +100848,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-40536, CISA KEV (added 2026-02-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 access bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 access bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21513": {
     "name": "Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability",
@@ -100699,7 +100960,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21513, CISA KEV (added 2026-02-10), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion + T1553.005 MoTW bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion + T1553.005 MoTW bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21525": {
     "name": "Microsoft Windows NULL Pointer Dereference Vulnerability",
@@ -100808,7 +101071,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21525, CISA KEV (added 2026-02-10), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21510": {
     "name": "Microsoft Windows Shell Protection Mechanism Failure Vulnerability",
@@ -100918,7 +101183,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21510, CISA KEV (added 2026-02-10), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion + T1553.005 MoTW bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion + T1553.005 MoTW bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21533": {
     "name": "Microsoft Windows Improper Privilege Management Vulnerability",
@@ -101027,7 +101294,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21533, CISA KEV (added 2026-02-10), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21519": {
     "name": "Microsoft Windows Type Confusion Vulnerability",
@@ -101136,7 +101405,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21519, CISA KEV (added 2026-02-10), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21514": {
     "name": "Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability",
@@ -101245,7 +101516,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21514, CISA KEV (added 2026-02-10), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-11953": {
     "name": "React Native Community CLI OS Command Injection Vulnerability",
@@ -101356,7 +101629,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-11953, CISA KEV (added 2026-02-05), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-24423": {
     "name": "SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability",
@@ -101468,7 +101743,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-24423, CISA KEV (added 2026-02-05), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-39935": {
     "name": "GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability",
@@ -101577,7 +101854,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-39935, CISA KEV (added 2026-02-03), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-64328": {
     "name": "Sangoma FreePBX OS Command Injection Vulnerability",
@@ -101687,7 +101966,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-64328, CISA KEV (added 2026-02-03), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2019-19006": {
     "name": " Sangoma FreePBX Improper Authentication Vulnerability",
@@ -101797,7 +102078,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2019-19006, CISA KEV (added 2026-02-03), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-40551": {
     "name": "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability (variant: CVE-2025-40551)",
@@ -101907,7 +102190,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-40551, CISA KEV (added 2026-02-03), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-1281": {
     "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (variant: CVE-2026-1281)",
@@ -102019,7 +102304,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-1281, CISA KEV (added 2026-01-29), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-24858": {
     "name": "Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability",
@@ -102130,7 +102417,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-24858, CISA KEV (added 2026-01-27), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2018-14634": {
     "name": "Linux Kernel Integer Overflow Vulnerability (CVE-2018-14634)",
@@ -102241,7 +102530,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2018-14634, CISA KEV (added 2026-01-26), and the kernel/distribution advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-52691": {
     "name": "SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -102353,7 +102644,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-52691, CISA KEV (added 2026-01-26), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1505.003 web shell) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1505.003 web shell) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-23760": {
     "name": "SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability",
@@ -102464,7 +102757,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-23760, CISA KEV (added 2026-01-26), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-24061": {
     "name": "GNU InetUtils Argument Injection Vulnerability",
@@ -102577,7 +102872,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-24061, CISA KEV (added 2026-01-26), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-21509": {
     "name": "Microsoft Office Security Feature Bypass Vulnerability",
@@ -102686,7 +102983,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-21509, CISA KEV (added 2026-01-26), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1211 defense-evasion) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-37079": {
     "name": "Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability",
@@ -102795,7 +103094,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-37079, CISA KEV (added 2026-01-23), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-68645": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability",
@@ -102905,7 +103206,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-68645, CISA KEV (added 2026-01-22), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-34026": {
     "name": "Versa Concerto Improper Authentication Vulnerability",
@@ -103015,7 +103318,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-34026, CISA KEV (added 2026-01-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-31125": {
     "name": "Vite Vitejs Improper Access Control Vulnerability",
@@ -103126,7 +103431,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-31125, CISA KEV (added 2026-01-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-54313": {
     "name": "Prettier eslint-config-prettier Embedded Malicious Code Vulnerability",
@@ -103236,7 +103543,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-54313, CISA KEV (added 2026-01-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20045": {
     "name": "Cisco Unified Communications Products Code Injection Vulnerability",
@@ -103346,7 +103655,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20045, CISA KEV (added 2026-01-21), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20805": {
     "name": "Microsoft Windows Information Disclosure Vulnerability",
@@ -103455,7 +103766,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2026-20805, CISA KEV (added 2026-01-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-8110": {
     "name": "Gogs Path Traversal Vulnerability",
@@ -103564,7 +103877,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-8110, CISA KEV (added 2026-01-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2009-0556": {
     "name": "Microsoft Office PowerPoint Code Injection Vulnerability",
@@ -103673,7 +103988,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2009-0556, CISA KEV (added 2026-01-07), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-37164": {
     "name": "Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability",
@@ -103783,7 +104100,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-37164, CISA KEV (added 2026-01-07), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-52163": {
     "name": "Digiever DS-2105 Pro Missing Authorization Vulnerability",
@@ -103893,7 +104212,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-52163, CISA KEV (added 2025-12-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-14733": {
     "name": "WatchGuard Firebox Out of Bounds Write Vulnerability",
@@ -104002,7 +104323,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-14733, CISA KEV (added 2025-12-19), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-59374": {
     "name": "ASUS Live Update Embedded Malicious Code Vulnerability",
@@ -104111,7 +104434,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59374, CISA KEV (added 2025-12-17), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1195.002 software supply-chain compromise) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-40602": {
     "name": "SonicWall SMA1000 Missing Authorization Vulnerability",
@@ -104222,7 +104547,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-40602, CISA KEV (added 2025-12-17), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 access bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 access bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-20393": {
     "name": "Cisco Multiple Products Improper Input Validation Vulnerability",
@@ -104331,7 +104658,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-20393, CISA KEV (added 2025-12-17), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-59718": {
     "name": "Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability",
@@ -104441,7 +104770,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59718, CISA KEV (added 2025-12-16), and the Fortinet PSIRT advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-14611": {
     "name": "Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability",
@@ -104553,7 +104884,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-14611, CISA KEV (added 2025-12-15), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2018-4063": {
     "name": "Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -104665,7 +104998,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2018-4063, CISA KEV (added 2025-12-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-58360": {
     "name": "OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability",
@@ -104775,7 +105110,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-58360, CISA KEV (added 2025-12-11), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-6218": {
     "name": "RARLAB WinRAR Path Traversal Vulnerability",
@@ -104885,7 +105222,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-6218, CISA KEV (added 2025-12-09), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 + T1547.001) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 + T1547.001) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-62221": {
     "name": "Microsoft Windows Use After Free Vulnerability",
@@ -104994,7 +105333,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62221, CISA KEV (added 2025-12-09), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-37055": {
     "name": "D-Link Routers Buffer Overflow Vulnerability",
@@ -105103,7 +105444,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2022-37055, CISA KEV (added 2025-12-08), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-66644": {
     "name": "Array Networks ArrayOS AG OS Command Injection Vulnerability",
@@ -105214,7 +105557,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-66644, CISA KEV (added 2025-12-08), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-55182": {
     "name": "Meta React Server Components Remote Code Execution Vulnerability",
@@ -105326,7 +105671,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-55182, CISA KEV (added 2025-12-05), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-26828": {
     "name": "OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability",
@@ -105436,7 +105783,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-26828, CISA KEV (added 2025-12-03), and the vendor / CISA ICS advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48633": {
     "name": "Android Framework Information Disclosure Vulnerability",
@@ -105545,7 +105894,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48633, CISA KEV (added 2025-12-02), and the Android security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48572": {
     "name": "Android Framework Privilege Escalation Vulnerability",
@@ -105653,7 +106004,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48572, CISA KEV (added 2025-12-02), and the Android security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-26829": {
     "name": "OpenPLC ScadaBR Cross-site Scripting Vulnerability",
@@ -105762,7 +106115,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-26829, CISA KEV (added 2025-11-28), and the vendor / CISA ICS advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-61757": {
     "name": "Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability",
@@ -105872,7 +106227,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-61757, CISA KEV (added 2025-11-21), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-13223": {
     "name": "Google Chromium V8 Type Confusion Vulnerability (CVE-2025-13223)",
@@ -105981,7 +106338,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-13223, CISA KEV (added 2025-11-19), and the Google Chrome/Chromium security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-58034": {
     "name": "Fortinet FortiWeb OS Command Injection Vulnerability",
@@ -106091,7 +106450,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-58034, CISA KEV (added 2025-11-18), and the Fortinet PSIRT advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-64446": {
     "name": "Fortinet FortiWeb Path Traversal Vulnerability",
@@ -106200,7 +106561,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-64446, CISA KEV (added 2025-11-14), and the Fortinet PSIRT advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-12480": {
     "name": "Gladinet Triofox Improper Access Control Vulnerability",
@@ -106310,7 +106673,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-12480, CISA KEV (added 2025-11-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-62215": {
     "name": "Microsoft Windows Race Condition Vulnerability",
@@ -106418,7 +106783,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62215, CISA KEV (added 2025-11-12), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-9242": {
     "name": "WatchGuard Firebox Out-of-Bounds Write Vulnerability",
@@ -106527,7 +106894,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-9242, CISA KEV (added 2025-11-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-21042": {
     "name": "Samsung Mobile Devices Out-of-Bounds Write Vulnerability",
@@ -106636,7 +107005,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-21042, CISA KEV (added 2025-11-10), and the Samsung security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48703": {
     "name": "CWP Control Web Panel OS Command Injection Vulnerability (CVE-2025-48703)",
@@ -106746,7 +107117,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48703, CISA KEV (added 2025-11-04), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-11371": {
     "name": "Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability",
@@ -106856,7 +107229,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-11371, CISA KEV (added 2025-11-04), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-41244": {
     "name": "Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability",
@@ -106965,7 +107340,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-41244, CISA KEV (added 2025-10-30), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24893": {
     "name": "XWiki Platform Eval Injection Vulnerability",
@@ -107075,7 +107452,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-24893, CISA KEV (added 2025-10-30), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-6204": {
     "name": "Dassault Systèmes DELMIA Apriso Code Injection Vulnerability",
@@ -107185,7 +107564,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-6204, CISA KEV (added 2025-10-28), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-6205": {
     "name": "Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability",
@@ -107295,7 +107676,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-6205, CISA KEV (added 2025-10-28), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-54236": {
     "name": "Adobe Commerce and Magento Improper Input Validation Vulnerability",
@@ -107405,7 +107788,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-54236, CISA KEV (added 2025-10-24), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-59287": {
     "name": "Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability",
@@ -107514,7 +107899,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59287, CISA KEV (added 2025-10-24), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-61932": {
     "name": "Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability",
@@ -107624,7 +108011,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-61932, CISA KEV (added 2025-10-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-48503": {
     "name": "Apple Multiple Products Unspecified Vulnerability",
@@ -107737,7 +108126,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2022-48503, CISA KEV (added 2025-10-20), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-2746": {
     "name": "Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability",
@@ -107847,7 +108238,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-2746, CISA KEV (added 2025-10-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-2747": {
     "name": "Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability (variant: CVE-2025-2747)",
@@ -107957,7 +108350,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-2747, CISA KEV (added 2025-10-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-33073": {
     "name": "Microsoft Windows SMB Client Improper Access Control Vulnerability",
@@ -108067,7 +108462,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-33073, CISA KEV (added 2025-10-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation + T1557.001 NTLM relay) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation + T1557.001 NTLM relay) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-61884": {
     "name": "Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability",
@@ -108177,7 +108574,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-61884, CISA KEV (added 2025-10-20), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-54253": {
     "name": "Adobe Experience Manager Forms Code Execution Vulnerability",
@@ -108287,7 +108686,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-54253, CISA KEV (added 2025-10-15), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-47827": {
     "name": "IGEL OS Use of a Key Past its Expiration Date Vulnerability",
@@ -108396,7 +108797,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-47827, CISA KEV (added 2025-10-14), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1553) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1553) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24990": {
     "name": "Microsoft Windows Untrusted Pointer Dereference Vulnerability",
@@ -108504,7 +108907,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-24990, CISA KEV (added 2025-10-14), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-59230": {
     "name": "Microsoft Windows Improper Access Control Vulnerability",
@@ -108613,7 +109018,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59230, CISA KEV (added 2025-10-14), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2016-7836": {
     "name": "SKYSEA Client View Improper Authentication Vulnerability",
@@ -108723,7 +109130,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2016-7836, CISA KEV (added 2025-10-14), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-43798": {
     "name": "Grafana Path Traversal Vulnerability",
@@ -108833,7 +109242,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-43798, CISA KEV (added 2025-10-09), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-27915": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (variant: CVE-2025-27915)",
@@ -108942,7 +109353,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-27915, CISA KEV (added 2025-10-07), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-22555": {
     "name": "Linux Kernel Heap Out-of-Bounds Write Vulnerability",
@@ -109053,7 +109466,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-22555, CISA KEV (added 2025-10-06), and the kernel/distribution advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2010-3962": {
     "name": "Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability",
@@ -109162,7 +109577,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2010-3962, CISA KEV (added 2025-10-06), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-43226": {
     "name": "Microsoft Windows Privilege Escalation Vulnerability",
@@ -109270,7 +109687,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-43226, CISA KEV (added 2025-10-06), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2013-3918": {
     "name": "Microsoft Windows Out-of-Bounds Write Vulnerability",
@@ -109379,7 +109798,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2013-3918, CISA KEV (added 2025-10-06), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2011-3402": {
     "name": "Microsoft Windows Remote Code Execution Vulnerability (CVE-2011-3402)",
@@ -109488,7 +109909,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2011-3402, CISA KEV (added 2025-10-06), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2010-3765": {
     "name": "Mozilla Multiple Products Remote Code Execution Vulnerability",
@@ -109597,7 +110020,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2010-3765, CISA KEV (added 2025-10-06), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-61882": {
     "name": "Oracle E-Business Suite Unspecified Vulnerability (CVE-2025-61882)",
@@ -109708,7 +110133,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-61882, CISA KEV (added 2025-10-06), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2014-6278": {
     "name": "GNU Bash OS Command Injection Vulnerability",
@@ -109821,7 +110248,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2014-6278, CISA KEV (added 2025-10-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2017-1000353": {
     "name": "Jenkins Remote Code Execution Vulnerability",
@@ -109931,7 +110360,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2017-1000353, CISA KEV (added 2025-10-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2015-7755": {
     "name": "Juniper ScreenOS Improper Authentication Vulnerability",
@@ -110041,7 +110472,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2015-7755, CISA KEV (added 2025-10-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-21043": {
     "name": "Samsung Mobile Devices Out-of-Bounds Write Vulnerability (variant: CVE-2025-21043)",
@@ -110150,7 +110583,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-21043, CISA KEV (added 2025-10-02), and the Samsung security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-4008": {
     "name": "Smartbedded Meteobridge Command Injection Vulnerability",
@@ -110261,7 +110696,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-4008, CISA KEV (added 2025-10-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32463": {
     "name": "Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
@@ -110370,7 +110807,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32463, CISA KEV (added 2025-09-29), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-59689": {
     "name": "Libraesva Email Security Gateway Command Injection Vulnerability",
@@ -110480,7 +110919,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59689, CISA KEV (added 2025-09-29), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-10035": {
     "name": "Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability",
@@ -110592,7 +111033,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-10035, CISA KEV (added 2025-09-29), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-20352": {
     "name": "Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability",
@@ -110702,7 +111145,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-20352, CISA KEV (added 2025-09-29), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-21311": {
     "name": "Adminer Server-Side Request Forgery Vulnerability",
@@ -110811,7 +111256,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-21311, CISA KEV (added 2025-09-29), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-20362": {
     "name": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability",
@@ -110925,7 +111372,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-20362, CISA KEV (added 2025-09-25), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-20333": {
     "name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability",
@@ -111039,7 +111488,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-20333, CISA KEV (added 2025-09-25), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-5086": {
     "name": "Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability",
@@ -111149,7 +111600,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-5086, CISA KEV (added 2025-09-11), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48543": {
     "name": "Android Runtime Use-After-Free Vulnerability",
@@ -111257,7 +111710,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48543, CISA KEV (added 2025-09-04), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-53690": {
     "name": "Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability",
@@ -111367,7 +111822,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-53690, CISA KEV (added 2025-09-04), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-50224": {
     "name": "TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability",
@@ -111477,7 +111934,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-50224, CISA KEV (added 2025-09-03), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-9377": {
     "name": "TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability",
@@ -111587,7 +112046,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-9377, CISA KEV (added 2025-09-03), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-24363": {
     "name": "TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability",
@@ -111698,7 +112159,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2020-24363, CISA KEV (added 2025-09-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-55177": {
     "name": "Meta Platforms WhatsApp Incorrect Authorization Vulnerability",
@@ -111807,7 +112270,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-55177, CISA KEV (added 2025-09-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-57819": {
     "name": "Sangoma FreePBX Authentication Bypass Vulnerability",
@@ -111918,7 +112383,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-57819, CISA KEV (added 2025-08-29), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-7775": {
     "name": "Citrix NetScaler Memory Overflow Vulnerability",
@@ -112027,7 +112494,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-7775, CISA KEV (added 2025-08-26), and the Citrix security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48384": {
     "name": "Git Link Following Vulnerability",
@@ -112141,7 +112610,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48384, CISA KEV (added 2025-08-25), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1204.002) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1204.002) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-8068": {
     "name": "Citrix Session Recording Improper Privilege Management Vulnerability",
@@ -112250,7 +112721,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-8068, CISA KEV (added 2025-08-25), and the Citrix security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-8069": {
     "name": "Citrix Session Recording Deserialization of Untrusted Data Vulnerability",
@@ -112360,7 +112833,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-8069, CISA KEV (added 2025-08-25), and the Citrix security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-54948": {
     "name": "Trend Micro Apex One OS Command Injection Vulnerability",
@@ -112470,7 +112945,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-54948, CISA KEV (added 2025-08-18), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-8876": {
     "name": "N-able N-Central Command Injection Vulnerability",
@@ -112580,7 +113057,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-8876, CISA KEV (added 2025-08-13), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-8875": {
     "name": "N-able N-Central Insecure Deserialization Vulnerability",
@@ -112690,7 +113169,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-8875, CISA KEV (added 2025-08-13), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-8088": {
     "name": "RARLAB WinRAR Path Traversal Vulnerability (variant: CVE-2025-8088)",
@@ -112800,7 +113281,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-8088, CISA KEV (added 2025-08-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 + T1547.001) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 + T1547.001) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2007-0671": {
     "name": "Microsoft Office Excel Remote Code Execution Vulnerability",
@@ -112909,7 +113392,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2007-0671, CISA KEV (added 2025-08-12), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2013-3893": {
     "name": "Microsoft Internet Explorer Resource Management Errors Vulnerability",
@@ -113018,7 +113503,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2013-3893, CISA KEV (added 2025-08-12), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-25078": {
     "name": "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability",
@@ -113130,7 +113617,9 @@
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. KEV/vendor_advisories retained from the verified import. The CVSS score/vector and the CWE assignment were later corrected against NVD — the import had estimated 8.8 (C:H/I:H/A:H) and CWE-94 from the KEV vulnerabilityName, while the verified primitive is administrator-password disclosure from an unauthenticated endpoint; see cvss_note and cwe_note. The ATT&CK refs, IoCs and attack class were re-derived from that corrected reading.",
-    "cwe_note": "NVD assigns NVD-CWE-noinfo; classified as CWE-200 (Exposure of Sensitive Information) per the confidentiality-only impact (C:H/I:N/A:N) and the NVD description, which records an unauthenticated /config/getuser endpoint disclosing the administrator password. Supersedes an earlier CWE-94 (Code Injection) assignment that the primitive does not support."
+    "cwe_note": "NVD assigns NVD-CWE-noinfo; classified as CWE-200 (Exposure of Sensitive Information) per the confidentiality-only impact (C:H/I:N/A:N) and the NVD description, which records an unauthenticated /config/getuser endpoint disclosing the administrator password. Supersedes an earlier CWE-94 (Code Injection) assignment that the primitive does not support.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2020-25079": {
     "name": "D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability",
@@ -113241,7 +113730,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2020-25079, CISA KEV (added 2025-08-05), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-40799": {
     "name": "D-Link DNR-322L Download of Code Without Integrity Check Vulnerability",
@@ -113350,7 +113841,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2022-40799, CISA KEV (added 2025-08-05), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-2533": {
     "name": "PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability",
@@ -113459,7 +113952,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-2533, CISA KEV (added 2025-07-28), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-20337": {
     "name": "Cisco Identity Services Engine Injection Vulnerability",
@@ -113569,7 +114064,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-20337, CISA KEV (added 2025-07-28), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-20281": {
     "name": "Cisco Identity Services Engine Injection Vulnerability (variant: CVE-2025-20281)",
@@ -113679,7 +114176,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-20281, CISA KEV (added 2025-07-28), and the Cisco security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-2775": {
     "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
@@ -113788,7 +114287,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-2775, CISA KEV (added 2025-07-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-2776": {
     "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability (variant: CVE-2025-2776)",
@@ -113897,7 +114398,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-2776, CISA KEV (added 2025-07-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-6558": {
     "name": "Google Chromium ANGLE and GPU Improper Input Validation Vulnerability",
@@ -114007,7 +114510,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-6558, CISA KEV (added 2025-07-22), and the Google Chrome/Chromium security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 sandbox escape) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution + T1068 sandbox escape) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-54309": {
     "name": " CrushFTP Unprotected Alternate Channel Vulnerability",
@@ -114117,7 +114622,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-54309, CISA KEV (added 2025-07-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 access bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 access bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-49704": {
     "name": "Microsoft SharePoint Code Injection Vulnerability",
@@ -114231,7 +114738,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-49704, CISA KEV (added 2025-07-22), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-49706": {
     "name": "Microsoft SharePoint Improper Authentication Vulnerability",
@@ -114344,7 +114853,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-49706, CISA KEV (added 2025-07-22), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-53770": {
     "name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (variant: CVE-2025-53770)",
@@ -114457,7 +114968,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-53770, CISA KEV (added 2025-07-20), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-25257": {
     "name": "Fortinet FortiWeb SQL Injection Vulnerability",
@@ -114566,7 +115079,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-25257, CISA KEV (added 2025-07-18), and the Fortinet PSIRT advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-47812": {
     "name": "Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability",
@@ -114676,7 +115191,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-47812, CISA KEV (added 2025-07-14), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-5777": {
     "name": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability",
@@ -114787,7 +115304,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-5777, CISA KEV (added 2025-07-10), and the Citrix security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2019-9621": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability",
@@ -114898,7 +115417,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2019-9621, CISA KEV (added 2025-07-07), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2019-5418": {
     "name": "Rails Ruby on Rails Path Traversal Vulnerability",
@@ -115008,7 +115529,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2019-5418, CISA KEV (added 2025-07-07), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2016-10033": {
     "name": "PHPMailer Command Injection Vulnerability",
@@ -115120,7 +115643,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2016-10033, CISA KEV (added 2025-07-07), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 command/code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2014-3931": {
     "name": "Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability",
@@ -115229,7 +115754,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2014-3931, CISA KEV (added 2025-07-07), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190 + T1059) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1190 + T1059) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-6554": {
     "name": "Google Chromium V8 Type Confusion Vulnerability (variant: CVE-2025-6554)",
@@ -115338,7 +115865,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-6554, CISA KEV (added 2025-07-02), and the Google Chrome/Chromium security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48928": {
     "name": "TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability",
@@ -115440,7 +115969,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48928, CISA KEV (added 2025-07-01), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-48927": {
     "name": "TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability",
@@ -115542,7 +116073,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-48927, CISA KEV (added 2025-07-01), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-6543": {
     "name": "Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability",
@@ -115652,7 +116185,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-6543, CISA KEV (added 2025-06-30), and the Citrix security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2019-6693": {
     "name": "Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability",
@@ -115763,7 +116298,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2019-6693, CISA KEV (added 2025-06-25), and the Fortinet PSIRT advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-0769": {
     "name": " D-Link DIR-859 Router Path Traversal Vulnerability",
@@ -115873,7 +116410,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-0769, CISA KEV (added 2025-06-25), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-54085": {
     "name": "AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability",
@@ -115984,7 +116523,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-54085, CISA KEV (added 2025-06-25), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-0386": {
     "name": "Linux Kernel Improper Ownership Management Vulnerability",
@@ -116095,7 +116636,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-0386, CISA KEV (added 2025-06-17), and the kernel/distribution advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-33538": {
     "name": "TP-Link Multiple Routers Command Injection Vulnerability",
@@ -116205,7 +116748,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-33538, CISA KEV (added 2025-06-16), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-43200": {
     "name": "Apple Multiple Products Unspecified Vulnerability (variant: CVE-2025-43200)",
@@ -116320,7 +116865,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-43200, CISA KEV (added 2025-06-16), and the Apple security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-33053": {
     "name": " Microsoft Windows External Control of File Name or Path Vulnerability",
@@ -116430,7 +116977,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-33053, CISA KEV (added 2025-06-10), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1203 + T1204.002) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-30: ATT&CK enrichment (T1203 + T1204.002) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24016": {
     "name": "Wazuh Server Deserialization of Untrusted Data Vulnerability",
@@ -116541,7 +117090,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-24016, CISA KEV (added 2025-06-10), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-42009": {
     "name": "RoundCube Webmail Cross-Site Scripting Vulnerability",
@@ -116651,7 +117202,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-42009, CISA KEV (added 2025-06-09), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1539 steal web session cookie) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1539 steal web session cookie) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32433": {
     "name": "Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability",
@@ -116763,7 +117316,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32433, CISA KEV (added 2025-06-09), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass + T1059 RCE) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1078 auth bypass + T1059 RCE) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-5419": {
     "name": "Google Chromium V8 Out-of-Bounds Read and Write Vulnerability",
@@ -116873,7 +117428,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-5419, CISA KEV (added 2025-06-05), and the Google Chrome/Chromium security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-21479": {
     "name": "Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability",
@@ -116981,7 +117538,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-21479, CISA KEV (added 2025-06-03), and the Qualcomm security bulletin advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-21480": {
     "name": "Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability (variant: CVE-2025-21480)",
@@ -117089,7 +117648,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-21480, CISA KEV (added 2025-06-03), and the Qualcomm security bulletin advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-27038": {
     "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
@@ -117197,7 +117758,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-27038, CISA KEV (added 2025-06-03), and the Qualcomm security bulletin advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-32030": {
     "name": "ASUS Routers Improper Authentication Vulnerability",
@@ -117308,7 +117871,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2021-32030, CISA KEV (added 2025-06-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-3935": {
     "name": "ConnectWise ScreenConnect Improper Authentication Vulnerability",
@@ -117418,7 +117983,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-3935, CISA KEV (added 2025-06-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-35939": {
     "name": "Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability",
@@ -117527,7 +118094,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-35939, CISA KEV (added 2025-06-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-56145": {
     "name": "Craft CMS Code Injection Vulnerability (variant: CVE-2024-56145)",
@@ -117637,7 +118206,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-56145, CISA KEV (added 2025-06-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-39780": {
     "name": "ASUS RT-AX55 Routers OS Command Injection Vulnerability",
@@ -117748,7 +118319,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-39780, CISA KEV (added 2025-06-02), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-4632": {
     "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability (variant: CVE-2025-4632)",
@@ -117857,7 +118430,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-4632, CISA KEV (added 2025-05-22), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2023-38950": {
     "name": "ZKTeco BioTime Path Traversal Vulnerability",
@@ -117967,7 +118542,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2023-38950, CISA KEV (added 2025-05-19), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-27443": {
     "name": "Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability",
@@ -118078,7 +118655,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-27443, CISA KEV (added 2025-05-19), and the Zimbra security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-27920": {
     "name": "Srimax Output Messenger Directory Traversal Vulnerability",
@@ -118187,7 +118766,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-27920, CISA KEV (added 2025-05-19), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-11182": {
     "name": "MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability",
@@ -118298,7 +118879,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-11182, CISA KEV (added 2025-05-19), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1539 steal web session cookie) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1539 steal web session cookie) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-4428": {
     "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (variant: CVE-2025-4428)",
@@ -118408,7 +118991,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-4428, CISA KEV (added 2025-05-19), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-4427": {
     "name": "Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability",
@@ -118518,7 +119103,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-4427, CISA KEV (added 2025-05-19), and the vendor advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-42999": {
     "name": "SAP NetWeaver Deserialization Vulnerability",
@@ -118628,7 +119215,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-42999, CISA KEV (added 2025-05-15), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1059 code execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-12987": {
     "name": "DrayTek Vigor Routers OS Command Injection Vulnerability",
@@ -118740,7 +119329,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-12987, CISA KEV (added 2025-05-15), and the vendor security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32756": {
     "name": "Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability",
@@ -118849,7 +119440,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32756, CISA KEV (added 2025-05-14), and the Fortinet PSIRT advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32709": {
     "name": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
@@ -118957,7 +119550,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32709, CISA KEV (added 2025-05-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-30397": {
     "name": "Microsoft Windows Scripting Engine Type Confusion Vulnerability",
@@ -119066,7 +119661,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-30397, CISA KEV (added 2025-05-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32706": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability",
@@ -119175,7 +119772,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32706, CISA KEV (added 2025-05-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-32701": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
@@ -119283,7 +119882,9 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-32701, CISA KEV (added 2025-05-13), and the Microsoft security advisory recorded in vendor_advisories."
     },
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import."
+    "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1068 privilege escalation) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-12450": {
     "name": "RAGFlow web_crawl Full-Read SSRF + Arbitrary File Read",
@@ -121464,7 +122065,9 @@
       "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
     ],
     "last_updated": "2026-06-01",
-    "discovery_attribution_note": "Co-disclosed October 2023 by Google, Cloudflare and AWS after absorbing the largest-recorded HTTP/2 DDoS to that date; CISA KEV-listed 2023-10-10. Vendor research; no AI involvement."
+    "discovery_attribution_note": "Co-disclosed October 2023 by Google, Cloudflare and AWS after absorbing the largest-recorded HTTP/2 DDoS to that date; CISA KEV-listed 2023-10-10. Vendor research; no AI involvement.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2022-0492": {
     "name": "Linux Kernel cgroups v1 release_agent Privilege Escalation / Container Escape (CISA KEV)",
@@ -121579,7 +122182,9 @@
     ],
     "last_updated": "2026-06-13",
     "discovery_attribution_note": "Manually curated from the upstream Linux kernel fix commit (24f60085, kernel/cgroup/cgroup-v1.c) + NVD (CVSS v3.1 7.8; CWE-287/CWE-862) + the CISA KEV listing (added 2026-06-02) + the Palo Alto Unit 42 container-escape technique writeup and public check tool.",
-    "_kev_short_description": "The Linux kernel cgroups v1 release_agent write does not authorize the namespace context (CWE-862/CWE-287), letting an unprivileged or containerized process run code as root in the host's initial namespace - container escape / local privilege escalation; CISA KEV (added 2026-06-02, actively exploited), fixed by kernel commit 24f60085 and per-series kernel updates."
+    "_kev_short_description": "The Linux kernel cgroups v1 release_agent write does not authorize the namespace context (CWE-862/CWE-287), letting an unprivileged or containerized process run code as root in the host's initial namespace - container escape / local privilege escalation; CISA KEV (added 2026-06-02, actively exploited), fixed by kernel commit 24f60085 and per-series kernel updates.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-11120": {
     "name": "GeoVision EOL IP Devices Unauthenticated OS Command Injection (CISA KEV)",
@@ -121793,7 +122398,9 @@
     "last_updated": "2026-06-13",
     "discovery_attribution_note": "Manually curated from the Oracle Critical Patch Update for July 2024 + NVD (CVSS v3.1 7.5, confidentiality-only vector C:H/I:N/A:N; NVD-CWE-noinfo - no CWE assigned) + the CISA KEV listing (added 2026-06-01). Oracle WebLogic unauthenticated T3/IIOP data-access flaw; no public PoC located and no CWE assigned at curation.",
     "_kev_short_description": "Oracle WebLogic Server lets an unauthenticated network attacker over T3/IIOP access critical data (confidentiality-only, C:H/I:N/A:N; NVD-CWE-noinfo); CISA KEV (added 2026-06-01, actively exploited), fixed by the July 2024 Oracle Critical Patch Update.",
-    "cwe_note": "NVD assigns NVD-CWE-noinfo; classified as CWE-200 (Exposure of Sensitive Information) per the confidentiality-only impact (C:H/I:N/A:N)."
+    "cwe_note": "NVD assigns NVD-CWE-noinfo; classified as CWE-200 (Exposure of Sensitive Information) per the confidentiality-only impact (C:H/I:N/A:N).",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-6047": {
     "name": "GeoVision EOL Devices Unauthenticated OS Command Injection (CISA KEV)",
@@ -122341,7 +122948,9 @@
     ],
     "last_updated": "2026-06-13",
     "discovery_attribution_note": "Manually curated from the Android Security Bulletin (2026-06-01) + NVD (CVSS v3.1 8.4; CWE-190 integer overflow) + the CISA KEV listing (added 2026-06-02). Android Framework local-privilege-escalation flaw; no public PoC located at curation.",
-    "_kev_short_description": "An Android Framework integer overflow (CWE-190) reaches a code-execution path that gives a local app elevated/system privilege with no user interaction; CISA KEV (added 2026-06-02, actively exploited), fixed at the 2026-06-01 Android security-patch level."
+    "_kev_short_description": "An Android Framework integer overflow (CWE-190) reaches a code-execution path that gives a local app elevated/system privilege with no user interaction; CISA KEV (added 2026-06-02, actively exploited), fixed at the 2026-06-01 Android security-patch level.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-0257": {
     "name": "Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass (CISA KEV)",
@@ -122413,7 +123022,7 @@
     "cwe_refs": [
       "CWE-565"
     ],
-    "known_ransomware_use": false,
+    "known_ransomware_use": true,
     "source_verified": "2026-06-13",
     "verification_sources": [
       "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
@@ -122456,7 +123065,8 @@
         "severity": "critical",
         "published_date": "2026-05-29"
       }
-    ]
+    ],
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-10520": {
     "name": "Ivanti Sentry Unauthenticated OS Command Injection to Root RCE (CISA KEV)",
@@ -123774,7 +124384,9 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20230": {
     "name": "Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
@@ -123877,7 +124489,9 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated SSRF-to-root, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated SSRF-to-root, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-67038": {
     "name": "Lantronix EDS5000 Code Injection Vulnerability",
@@ -123981,7 +124595,9 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the root OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the root OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-34910": {
     "name": "Ubiquiti UniFi OS Improper Input Validation Vulnerability",
@@ -124086,7 +124702,9 @@
     "_intake_method": "manual-verified-curation",
     "_kev_short_description": "Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.",
     "_draft": false,
-    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the package-update command injection, framework gaps mapped global-first, and a paired zero-day lesson added."
+    "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the package-update command injection, framework gaps mapped global-first, and a paired zero-day lesson added.",
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-34909": {
     "name": "Ubiquiti UniFi OS Path Traversal Vulnerability",
@@ -124195,8 +124813,9 @@
     "_kev_short_description": "Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path traversal (arbitrary file read/write), framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99116
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99116,
+    "known_ransomware_use": false
   },
   "CVE-2026-34908": {
     "name": "Ubiquiti UniFi OS Improper Access Control Vulnerability",
@@ -124303,8 +124922,9 @@
     "_kev_short_description": "Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the access-control bypass, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-19",
-    "epss_percentile": 0.99696
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99696,
+    "known_ransomware_use": false
   },
   "CVE-2026-20253": {
     "name": "Splunk Enterprise Missing Authentication for Critical Function Vulnerability",
@@ -124412,7 +125032,9 @@
     "_kev_short_description": "Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the missing authentication for a critical function, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99884
+    "epss_percentile": 0.99884,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-48907": {
     "name": "Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
@@ -124520,8 +125142,9 @@
     "_kev_short_description": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. ",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the editor access-control bypass enabling webshell upload, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-19",
-    "epss_percentile": 0.99286
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99286,
+    "known_ransomware_use": false
   },
   "CVE-2026-54420": {
     "name": "LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability",
@@ -124627,7 +125250,9 @@
     "_kev_short_description": "LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the symlink-following cross-account file access, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.70652
+    "epss_percentile": 0.70652,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-20262": {
     "name": "Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability",
@@ -124736,8 +125361,9 @@
     "_kev_short_description": "Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the path traversal, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.97923
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.97923,
+    "known_ransomware_use": false
   },
   "CVE-2025-34028": {
     "name": "Commvault Command Center Path Traversal Vulnerability",
@@ -124845,7 +125471,9 @@
     "_kev_short_description": "Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated path-traversal to RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99897
+    "epss_percentile": 0.99897,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-58136": {
     "name": "Yiiframework Yii Improper Protection of Alternate Path Vulnerability",
@@ -124951,7 +125579,9 @@
     "_kev_short_description": "Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the alternate-path protection bypass to RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99687
+    "epss_percentile": 0.99687,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-38475": {
     "name": "Apache HTTP Server Improper Escaping of Output Vulnerability",
@@ -125057,8 +125687,9 @@
     "_kev_short_description": "Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the mod_rewrite output-escaping flaw enabling unauthorized file mapping/disclosure, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99975
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99975,
+    "known_ransomware_use": false
   },
   "CVE-2023-44221": {
     "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
@@ -125164,7 +125795,9 @@
     "_kev_short_description": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99458
+    "epss_percentile": 0.99458,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-1976": {
     "name": "Broadcom Brocade Fabric OS Code Injection Vulnerability",
@@ -125271,7 +125904,9 @@
     "_kev_short_description": "Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the authenticated code injection to root, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.52636
+    "epss_percentile": 0.52636,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-42599": {
     "name": "Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability",
@@ -125375,7 +126010,9 @@
     "_kev_short_description": "Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the unauthenticated stack buffer overflow RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.86999
+    "epss_percentile": 0.86999,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-3928": {
     "name": "Commvault Web Server Unspecified Vulnerability",
@@ -125481,7 +126118,9 @@
     "_kev_short_description": "Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the webshell creation on the web server, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.79813
+    "epss_percentile": 0.79813,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24054": {
     "name": "Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability",
@@ -125593,8 +126232,9 @@
     "_kev_short_description": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the NTLM hash disclosure via crafted .library-ms files, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.99012
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.99012,
+    "known_ransomware_use": false
   },
   "CVE-2025-31201": {
     "name": "Apple Multiple Products Arbitrary Read and Write Vulnerability",
@@ -125700,7 +126340,9 @@
     "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the pointer-authentication (RPAC) bypass giving arbitrary read/write, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.96326
+    "epss_percentile": 0.96326,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-31200": {
     "name": "Apple Multiple Products Memory Corruption Vulnerability",
@@ -125807,7 +126449,9 @@
     "_kev_short_description": "Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-26: NVD CVSS/CWE retained, ATT&CK + IOCs derived from the CoreAudio memory-corruption RCE via a crafted media file, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.97135
+    "epss_percentile": 0.97135,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2021-20035": {
     "name": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
@@ -125914,7 +126558,9 @@
     "_kev_short_description": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authenticated OS command injection driven to code execution, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.89959
+    "epss_percentile": 0.89959,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-53150": {
     "name": "Linux Kernel Out-of-Bounds Read Vulnerability",
@@ -126024,7 +126670,9 @@
     "_kev_short_description": "Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel read, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.68889
+    "epss_percentile": 0.68889,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-53197": {
     "name": "Linux Kernel Out-of-Bounds Access Vulnerability",
@@ -126135,7 +126783,9 @@
     "_kev_short_description": "Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the USB-audio out-of-bounds kernel access, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.88216
+    "epss_percentile": 0.88216,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-29824": {
     "name": "Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability",
@@ -126242,7 +126892,9 @@
     "_kev_short_description": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the CLFS driver use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.96071
+    "epss_percentile": 0.96071,
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-30406": {
     "name": "Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability",
@@ -126348,7 +127000,9 @@
     "_kev_short_description": "Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the hard-coded machineKey enabling ViewState deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99835
+    "epss_percentile": 0.99835,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24813": {
     "name": "Apache Tomcat Path Equivalence Vulnerability",
@@ -126458,7 +127112,9 @@
     "_kev_short_description": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the path-equivalence partial-PUT deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99968
+    "epss_percentile": 0.99968,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-20439": {
     "name": "Cisco Smart Licensing Utility Static Credential Vulnerability",
@@ -126565,7 +127221,9 @@
     "_kev_short_description": "Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the undocumented static administrative credential, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99811
+    "epss_percentile": 0.99811,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-2783": {
     "name": "Google Chromium Mojo Sandbox Escape Vulnerability",
@@ -126669,7 +127327,9 @@
     "_kev_short_description": "Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS retained; CWE assigned editorially (NVD lists none for this entry), ATT&CK + IOCs derived from the Mojo IPC sandbox escape via an incorrectly-provided handle, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.94445
+    "epss_percentile": 0.94445,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2019-9875": {
     "name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (post-authentication)",
@@ -126774,7 +127434,9 @@
     "_kev_short_description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the post-authentication deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.96222
+    "epss_percentile": 0.96222,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2019-9874": {
     "name": "Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability (unauthenticated)",
@@ -126879,7 +127541,9 @@
     "_kev_short_description": "Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated deserialization RCE, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99666
+    "epss_percentile": 0.99666,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2017-12637": {
     "name": "SAP NetWeaver Directory Traversal Vulnerability",
@@ -126985,7 +127649,9 @@
     "_kev_short_description": "SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the directory-traversal arbitrary file disclosure, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99855
+    "epss_percentile": 0.99855,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2024-48248": {
     "name": "NAKIVO Backup and Replication Absolute Path Traversal Vulnerability",
@@ -127090,7 +127756,9 @@
     "_kev_short_description": "NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated absolute-path arbitrary file read, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99842
+    "epss_percentile": 0.99842,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-1316": {
     "name": "Edimax IC-7100 IP Camera OS Command Injection Vulnerability",
@@ -127196,7 +127864,9 @@
     "_kev_short_description": "Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the unauthenticated OS command injection, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.99403
+    "epss_percentile": 0.99403,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24472": {
     "name": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability",
@@ -127304,7 +127974,9 @@
     "_kev_short_description": " Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the authentication bypass via a crafted CSF proxy request, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.87497
+    "epss_percentile": 0.87497,
+    "known_ransomware_use": true,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-21590": {
     "name": "Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability",
@@ -127416,7 +128088,9 @@
     "_kev_short_description": "Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the improper isolation allowing local code injection into Junos, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.7523
+    "epss_percentile": 0.7523,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24993": {
     "name": "Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability",
@@ -127527,7 +128201,9 @@
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS heap-based buffer overflow on mounting a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.80584
+    "epss_percentile": 0.80584,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24991": {
     "name": "Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability",
@@ -127642,7 +128318,9 @@
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS out-of-bounds read on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.78792
+    "epss_percentile": 0.78792,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24985": {
     "name": "Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability",
@@ -127754,7 +128432,9 @@
     "_kev_short_description": "Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Fast FAT integer overflow leading to a heap overflow on a crafted VHD, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.89119
+    "epss_percentile": 0.89119,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2025-24984": {
     "name": "Microsoft Windows NTFS Information Disclosure Vulnerability",
@@ -127863,8 +128543,9 @@
     "_kev_short_description": "Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the NTFS information disclosure via sensitive data written to a log, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "last_verified": "2026-08-08",
-    "epss_percentile": 0.78521
+    "last_verified": "2026-08-22",
+    "epss_percentile": 0.78521,
+    "known_ransomware_use": false
   },
   "CVE-2025-24983": {
     "name": "Microsoft Windows Win32k Use-After-Free Vulnerability",
@@ -127971,7 +128652,9 @@
     "_kev_short_description": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Win32k use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added.",
-    "epss_percentile": 0.68811
+    "epss_percentile": 0.68811,
+    "known_ransomware_use": false,
+    "last_verified": "2026-08-22"
   },
   "CVE-2026-60137": {
     "name": "WordPress Core SQL Injection Vulnerability",