@blamejs/exceptd-skills 0.21.0 → 0.21.2

package/data/cve-catalog.json

@@ -93,6 +93,598 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2026-53266": {
+    "name": "Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2026-53266)",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-787"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-09-18",
+    "cisa_kev_due_date": "2026-09-21",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable.  If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().",
+    "epss_score": 0.00276,
+    "epss_percentile": 0.20229,
+    "epss_date": "2026-09-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-53266",
+    "vendor_advisories": [
+      {
+        "vendor": "Linux kernel",
+        "id": "67ba971ae025",
+        "url": "https://github.com/gregkh/linux/commit/67ba971ae02514d85818fe0c32549ab4bfa3bf49",
+        "published": "2026-06-01"
+      },
+      {
+        "vendor": "Red Hat",
+        "id": "CVE-2026-53266",
+        "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-53266.json",
+        "published": "2026-06-01"
+      },
+      {
+        "vendor": "Red Hat",
+        "id": "RHSA-2026:36645",
+        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36645.json",
+        "published": "2026-07-08"
+      },
+      {
+        "vendor": "Red Hat",
+        "id": "RHSA-2026:70797",
+        "url": "https://access.redhat.com/errata/RHSA-2026:70797",
+        "published": "2026-09-23"
+      },
+      {
+        "vendor": "Canonical",
+        "id": "CVE-2026-53266",
+        "url": "https://ubuntu.com/security/CVE-2026-53266",
+        "published": "2026-06-25"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-53266",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    ],
+    "source_verified": "2026-09-23",
+    "last_updated": "2026-09-23",
+    "_kev_short_description": "Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
+    "type": "splice-file-page-write-kernel-lpe",
+    "blast_radius": 26,
+    "poc_available": false,
+    "poc_description": "No public exploit code was found. The NVD record carries no reference tagged Exploit: its eight kernel.org references are tagged Patch and the ninth is the CISA KEV listing. CISA's 18 September 2026 alert, the CVE record, Red Hat's security data and the Ubuntu, SUSE and Debian CVE pages do not point to exploit code, and searches for an Exploit-DB, Metasploit or nuclei listing for this CVE returned none. The public technical material is the fix commit, whose message describes the flaw and whose three-line diff adds a writability check, and the kernel CNA's scoring rationale, which describes the conditions for reaching the write; neither contains a reproducer. Since the KEV listing, Red Hat marks the CVE as having a known exploit. Its VEX file at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53266.json gives the basis as an exploit_status entry that cites the CISA KEV catalog, and names no repository, Exploit-DB id, Metasploit module or nuclei template, so the mark is a vendor statement of exploitation rather than published exploit code.",
+    "iocs": {
+      "behavioral": [
+        "A non-root account creating a user and network namespace, a bridge device inside it and ebtables nat-table rules with the snat target, for example through unshare or a rootless container runtime.",
+        "A container or service that holds CAP_NET_ADMIN in its own network namespace, for example a privileged container or one started with the NET_ADMIN capability, creating a bridge device and ebtables nat-table rules with the snat target inside that namespace. This path does not create a user namespace, so a watch on user namespace creation does not record it.",
+        "A local process moving pages of a file it cannot write, such as a setuid-root binary or a file under /etc, into a pipe or socket with splice(), vmsplice() or sendfile() on a host where ebtables nat rules with the ARP rewrite option are loaded in any network namespace.",
+        "A process running as root whose parent chain leads back to an unprivileged login or service account with no sudo, su or polkit authorization event in between."
+      ],
+      "network": [],
+      "host": [
+        "A running kernel (uname -r) on an affected upstream line below its fixed release: 5.10.x below 5.10.259, 5.15.x below 5.15.210, 6.1.x below 6.1.176, 6.6.x below 6.6.143, 6.12.x below 6.12.94, 6.18.x below 6.18.36, 7.0.x below 7.0.13, or a 7.1 release candidate from rc1 to rc6. Kernels on the other lines from 5.11 through 6.19, which have no fixed release listed, are affected at every version, and 5.4.73 and later, 5.8.17 and later and 5.9.2 and later kernels are affected with no fixed release listed on those lines.",
+        "A distribution kernel package below its fixed build: RHEL 9 kernel, or RHEL 9 Real Time or Real Time for NFV kernel-rt, below 5.14.0-687.23.1.el9_8; RHEL 8.10 kernel below 4.18.0-553.143.1.el8_10 or kernel-rt below 4.18.0-553.143.1.rt7.484.el8_10; RHEL 8.6 Advanced Mission Critical Update Support or 8.6 Extended Update Support Long-Life kernel below 4.18.0-372.217.1.el8_6; SLES 15 SP7 or SLES for SAP Applications 15 SP7 kernel-default below 6.4.0-150700.53.66.1; SLE Real Time 15 SP7 kernel-rt below 6.4.0-150700.7.62.1; SLES 16.0, openSUSE Leap 16.0 or SUSE Linux Micro 6.2 kernel-default below 6.12.0-160000.36.1; SUSE Linux Micro 6.0 or 6.1 kernel-default below 6.4.0-49.1; SUSE Liberty Linux 8 kernel below 4.18.0-553.143.1.el8_10 or SUSE Liberty Linux 9 kernel below 5.14.0-687.23.1.el9_8; Debian bullseye linux below 5.10.259-1 or linux-6.1 below 6.1.176-1~deb11u1 (bullseye reached the end of Debian Long Term Support on 31 August 2026), bookworm linux below 6.1.176-1, or trixie linux below 6.12.94-1; Ubuntu 26.04 linux below 7.0.0-31.31, or a 26.04 flavor kernel below its own fixed build (for example linux-aws below 7.0.0-1012.12, linux-azure below 7.0.0-1014.14 or linux-gcp below 7.0.0-1011.11); or Ubuntu 24.04 linux-hwe-7.0 below 7.0.0-31.31~24.04.1. Compare each Ubuntu flavor kernel against its own row on Ubuntu's page. Most 26.04 flavor builds carry ABI numbers of 1006 or higher (linux-gke 7.0.0-1006.7 through linux-nvidia-bos 7.0.0-2018.18), which sort above 31, so a check against the linux package boundary 7.0.0-31.31 can mark an unfixed flavor kernel as fixed. Kernels listed as affected with no fixed package: RHEL 10 and RHEL for NVIDIA 26; the RHEL 7 kernel and kernel-rt and the RHEL 6 kernel, which Red Hat's VEX file lists as affected with no fix while Red Hat's CVE data lists them as not affected; SLES 15 SP4, SP5 and SP6 LTSS, SLES for SAP Applications 15 SP4, SP5 and SP6, SLE HPC 15 SP4 and SP5 LTSS, and SLE Micro 5.3, 5.4 and 5.5; SUSE Manager Server, Proxy and Retail Branch Server 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 to SP6 and openSUSE Leap 15.4 to 15.6, which SUSE groups with products past their end of life; the Ubuntu 26.04 linux-azure-fde kernel; the Ubuntu 24.04 linux package and the other 24.04 kernel flavors Ubuntu lists as vulnerable; the Ubuntu 22.04 and 20.04 kernels; and the Ubuntu 18.04 5.4-based kernels (linux-hwe-5.4, linux-aws-5.4, linux-azure-5.4, linux-gcp-5.4, linux-ibm-5.4, linux-oracle-5.4 and linux-raspi-5.4).",
+        "A rule in the nat table that uses the snat target with the --snat-arp option, found by running both ebtables-legacy -t nat -L and ebtables-nft -t nat -L in the initial network namespace and in every other network namespace on the host. ebtables-nft adds and lists rules through the nf_tables kernel subsystem, while ebtables-legacy uses the legacy get/setsockopt interface, so a listing with one tool does not show a rule loaded through the other interface; where only one tool is installed, rules held by the other interface are not listed. Read every chain the nat table listing prints, including user-defined chains that POSTROUTING jumps to, not only POSTROUTING itself. List the namespaces with lsns -t net and run both listings inside each one, for example with nsenter --net=/proc/<pid>/ns/net ebtables-legacy -t nat -L. Red Hat's mitigation is to disable this ARP hardware address rewriting or remove such rules, so each hit marks a namespace where the vulnerable path is configured. A listing in the initial namespace alone does not show a rule created inside an unprivileged user's own network namespace or inside a container's network namespace, and a namespace that has already exited leaves no rule to list.",
+        "The ebt_snat module listed by lsmod on a host whose administrators have configured no ebtables NAT rules, which can mean that a rule was created inside another network namespace or through the ebtables interface the administrators do not use.",
+        "Kernel log entries (dmesg or journalctl -k) with an oops, warning or stack trace that names ebt_snat_tg or skb_store_bits.",
+        "Package verification (rpm -Va or debsums) reporting a changed checksum on a setuid binary or a file under /etc that no administrator changed. These tools read files through the page cache, so they detect a change held only in memory while the modified page stays cached."
+      ],
+      "_ioc_source_note": "The upstream kernel version boundaries come from the NVD record for CVE-2026-53266. The distribution package boundaries come from Red Hat's security data at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-53266.json, Red Hat's advisory data for RHSA-2026:36645 at https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36645.json (the RHEL 9 Real Time and Real Time for NFV kernel-rt builds) and its VEX file at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53266.json, Ubuntu's page at https://ubuntu.com/security/CVE-2026-53266 (including the per-flavor 26.04 builds and the 26.04 linux-azure-fde status), SUSE's page at https://www.suse.com/security/cve/CVE-2026-53266.html and Debian's tracker at https://security-tracker.debian.org/tracker/CVE-2026-53266. The end of Debian 11 bullseye Long Term Support on 31 August 2026 comes from Debian's release page at https://www.debian.org/releases/bullseye/. The RHEL 6 and RHEL 7 status comes from both Red Hat sources, which disagree: as of 23 September 2026 the VEX file lists the RHEL 6 kernel and the RHEL 7 kernel and kernel-rt as affected with no fix, and the security data lists them as not affected. The ebtables rule indicator is built from Red Hat's mitigation text and from two man pages. The ebtables man page at https://manpages.debian.org/bookworm/ebtables/ebtables-legacy.8.en.html documents that the snat target can only be used in the POSTROUTING chain of the nat table, that --snat-arp also changes the hardware source address inside the ARP header, and that a rule can jump to a user-defined chain. The xtables-nft man page at https://manpages.debian.org/bookworm/iptables/xtables-nft.8.en.html states that ebtables-nft adds and lists rules through the nf_tables kernel subsystem and contrasts that with the legacy get/setsockopt interface, so one tool's listing does not show rules loaded through the other interface. The rule indicator covers every network namespace for two reasons. The kernel CNA's scoring rationale in the CVE record at https://cveawg.mitre.org/api/cve/CVE-2026-53266 states that the rule path is reachable with namespace-local privileges through user and network namespaces. The kernel's ebtables rule-set handler in net/bridge/netfilter/ebtables.c, at https://raw.githubusercontent.com/gregkh/linux/master/net/bridge/netfilter/ebtables.c, checks CAP_NET_ADMIN against the user namespace that owns the network namespace, so a container or service granted CAP_NET_ADMIN in its own network namespace passes the same check. A listing in the initial namespace alone does not show a rule created inside another namespace. The function names ebt_snat_tg and skb_store_bits and the file net/bridge/netfilter/ebt_snat.c come from the fix commit at https://github.com/gregkh/linux/commit/67ba971ae02514d85818fe0c32549ab4bfa3bf49. The following items are general hunting heuristics rather than artifacts read from a source: all four behavioral items, the ebtables rule item (its two-tool, all-chain and per-namespace enumeration with lsns and nsenter), the loaded ebt_snat module item, the kernel log item and the package-verification item. The network group is empty because the flaw is local and no source consulted documents a network artifact for it. No published Sigma, nuclei, Elastic, Splunk or Microsoft detection rule for this CVE was found. No actor infrastructure, file hash or C2 address is listed, because no source consulted attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The fix commit names Yiming Qian as reporter and author, with sign-offs from Florian Westphal and Pablo Neira Ayuso, who committed it. No source consulted says AI tooling was used to find the flaw.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2026-53266 (CWE-787, CVSS 8.8) plus the CISA KEV entry (added 2026-09-18) and the upstream Linux fix commit 67ba971ae025, \"netfilter: bridge: make ebt_snat ARP rewrite writable\", which names Yiming Qian as reporter and author, with the kernel CNA's scoring rationale from the CVE record and distribution fix status from Red Hat, SUSE, Debian and Ubuntu.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2026-53266 to the KEV catalog on 2026-09-18 together with the Linux kernel race condition CVE-2025-39964, stating that the two were added based on evidence of active exploitation, and set a due date of 2026-09-21. KEV records known ransomware campaign use as Unknown, marks forensic triage as required, and its required action directs agencies to CISA's BOD 26-04 and its Forensics Triage Requirements. The CISA coordinator SSVC entry in the NVD record marks exploitation as active, automatable as no and technical impact as total. None of the sources consulted names a campaign, actor or incident report for this CVE.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, and security-relevant updates installed within organization-defined time periods. For this flaw the start of that period differs by distribution and by kernel package. The upstream fix was committed on 2026-06-01 and Red Hat shipped fixed RHEL 9 and RHEL 8.10 kernels in July 2026 and a fixed RHEL 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life kernel (RHSA-2026:70797) on 23 September 2026, after the 21 September KEV due date, but as of 22 September 2026 Ubuntu listed its 26.04 linux-azure-fde kernel, its 24.04 linux package, its 22.04 and 20.04 kernels and its 18.04 5.4-based kernels as vulnerable with no fixed package, Red Hat's data lists RHEL 10 and RHEL for NVIDIA 26 as affected with no fix, and SUSE lists SLES 15 SP4, SP5 and SP6 LTSS, SLES for SAP Applications 15 SP4 to SP6, SLE HPC 15 SP4 and SP5 LTSS and SLE Micro 5.3 to 5.5 as affected with no fix, together with SUSE Manager 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 to SP6 and openSUSE Leap 15.4 to 15.6, which it groups with products past their end of life. A period measured from vendor release has not started for those packages, and NVD lists no fixed release at all for the 5.4, 5.8 and 5.9 upstream lines, so an SI-2 report shows nothing overdue on the hosts that remain exposed after the KEV listing. For RHEL 6 and 7 the identification step depends on which Red Hat source is read: as of 23 September 2026 Red Hat's VEX file lists the RHEL 6 kernel and the RHEL 7 kernel and kernel-rt as affected with no fix, while its CVE data lists them as not affected, so a flaw report built from the CVE data does not list those hosts at all. On Ubuntu 24.04 the fixed build ships in a different kernel series, linux-hwe-7.0, so a report that tracks the installed package does not show that changing kernels would close the flaw.",
+      "NIST-800-53-CM-7": "CM-7 requires a system to provide only essential capabilities and to prohibit or restrict functions and services that are not needed. The vulnerable code is the optional ARP rewrite in the ebtables snat target (net/bridge/netfilter/ebt_snat.c). Red Hat describes the bridge netfilter rules it depends on as a specialized network configuration, but the kernel CNA states that the rule path is reachable with namespace-local privileges through user and network namespaces, and the kernel's ebtables rule-set handler checks CAP_NET_ADMIN against the user namespace that owns the network namespace. Exposure therefore also depends on whether unprivileged users can create those namespaces, on which containers and services hold CAP_NET_ADMIN in their own network namespaces and on whether the snat target can be loaded, not only on the rules the administrator wrote. CM-7 reviews are usually written against listening ports and installed services, so a loadable bridge netfilter target, unprivileged user namespace creation and a container's CAP_NET_ADMIN grant are not enumerated on a general-purpose host, and a port-and-service review does not prompt removing the --snat-arp option from ebtables SNAT rules (Red Hat's mitigation), blocking the ebt_snat module, restricting user namespaces where no workload uses them or removing CAP_NET_ADMIN from containers that do not need it.",
+      "NIST-800-53-SI-4": "SI-4 requires monitoring the system to detect attacks and indicators of potential attacks. In this flaw the kernel's bridge netfilter code copies the six-byte MAC address from the ebtables rule into a socket-buffer fragment backed by a file page imported with splice(). Because the kernel makes that copy itself rather than through a write() call on the file, monitoring built on file write events records no event for the change. A scheduled hash scan that reads files through the page cache, such as package verification, can detect the altered page while it stays cached, but the change itself does not trigger a scan, and no source publishes a detection rule for this CVE.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) requires essential and important entities to take measures for security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. It sets no timeframe, so an entity can show a documented handling process while its RHEL 10, SLES 15 SP4 to SP6 LTSS, SLE Micro 5.3 to 5.5, SUSE Manager 4.3 and LTS 4.3 and Ubuntu 22.04 hosts, its Ubuntu 24.04 hosts on the linux package, and its RHEL 7 hosts, which Red Hat's VEX file lists as affected with no fix, run kernels with no fixed package. For entities within the scope of Commission Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available, and additional measures, with the residual risk accepted, where a patch is not available, but it does not say which measures. Red Hat's published step for this flaw, disabling ARP hardware address rewriting in ebtables SNAT rules, covers only rules the administrator configured. The kernel CNA states that the rule path is reachable through user and network namespaces, and a container or service granted CAP_NET_ADMIN in its own network namespace passes the same capability check in the kernel's ebtables handler, so on those hosts exposure also depends on keeping the ebt_snat module from loading. Restricting unprivileged user namespaces closes only the first of those paths and removing unneeded CAP_NET_ADMIN grants closes only the second, so neither replaces the module block. An entity can therefore meet the requirement with Red Hat's ebtables rule change alone while the namespace paths stay open, because nothing in it calls for blocking the ebt_snat module.",
+      "UK-CAF-B4": "Principle B4 expects systems supporting essential functions to be securely configured and their vulnerabilities managed. Red Hat states that this flaw requires specific bridge netfilter rules to be configured, and the kernel CNA states that the rule path, which needs CAP_NET_ADMIN, is reachable with namespace-local privileges through user and network namespaces rather than requiring init-namespace root. The kernel's ebtables rule-set handler checks that capability against the user namespace that owns the network namespace, so a container or service granted CAP_NET_ADMIN in its own network namespace also reaches the rule path. A host's exposure therefore depends on its kernel version, on the ebtables nat rules in each of its network namespaces, on whether unprivileged users can create user and network namespaces and on which containers or services hold CAP_NET_ADMIN. A B4 assessment that matches kernel versions against advisories marks Ubuntu 22.04 hosts and Ubuntu 24.04 hosts on the linux package as vulnerable with no fix, without noting that 24.04 hosts can move to the fixed linux-hwe-7.0 kernel, and names no interim posture for the hosts that have no fixed package. It does not check for rules using the snat target with --snat-arp, which Red Hat's mitigation removes. It does not prompt blocking the ebt_snat module, which covers both namespace paths, or restricting unprivileged user namespaces and removing unneeded container CAP_NET_ADMIN grants, which each close one of them.",
+      "AU-Essential-8-Patch": "The Essential Eight patch operating systems control covers the Linux kernel. Its ISM controls apply to patches, updates or other vendor mitigations, so each window starts when the vendor publishes a fix or a mitigation, whichever comes first. At every maturity level, operating systems of internet-facing servers are patched within 48 hours of release when the vendor rates a flaw critical or a working exploit exists (ISM-1877), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). Workstations and non-internet-facing servers are patched within one month at Maturity Levels One and Two (ISM-1695); at Maturity Level Three, within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696), and within one month when the vendor rates it non-critical and no working exploit exists (ISM-1902). Before the KEV listing an operator saw only non-critical vendor ratings (Red Hat Important, SUSE moderate) and no public exploit, so the slower windows applied; on RHEL 9 and RHEL 8.10, where Red Hat released fixed kernels on 8 and 14 July 2026, those windows closed before the listing. On RHEL 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life, Red Hat released the fixed kernel 4.18.0-372.217.1.el8_6 (RHSA-2026:70797) on 23 September 2026, after the KEV listing, so a working exploit already existed when the window opened: internet-facing servers have 48 hours at every maturity level (ISM-1877), and other servers have one month at Maturity Levels One and Two (ISM-1695) and 48 hours at Maturity Level Three (ISM-1696). The KEV listing on 2026-09-18 means a working exploit exists. RHEL 10 and RHEL for NVIDIA 26 have no fixed kernel, but Red Hat has published a mitigation for them (disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces), so the window for applying it is running. As of 23 September 2026 Red Hat's VEX file also lists the RHEL 6 kernel and the RHEL 7 kernel and kernel-rt as affected with no fix and applies the same mitigation to them, so the window for applying it is running there too; Red Hat's CVE data lists those kernels as not affected, and an operator who reads only that source starts no window for them. Meeting that window leaves the namespace paths open: the mitigation covers only rules the administrator configured, the kernel CNA states that the rule path is reachable with namespace-local privileges through user and network namespaces, a container or service granted CAP_NET_ADMIN in its own network namespace passes the same capability check in the kernel's ebtables handler, and the control does not require steps the vendor did not publish, such as keeping the ebt_snat module from loading. As of 22 September 2026 Ubuntu listed its 26.04 linux-azure-fde kernel, its 24.04 linux package, its 22.04 and 20.04 kernels and its 18.04 5.4-based kernels as vulnerable with no fixed package. SUSE lists SLES 15 SP4, SP5 and SP6 LTSS, SLES for SAP Applications 15 SP4 to SP6, SLE HPC 15 SP4 and SP5 LTSS and SLE Micro 5.3 to 5.5 as affected with no fix. Neither vendor's CVE page gives a mitigation, so no window has started for those kernels; an Ubuntu 24.04 host can instead move to the fixed linux-hwe-7.0 kernel. Upstream 5.4.73 and later, 5.8.17 and later and 5.9.2 and later kernels have no fixed release listed; where such a kernel line is no longer supported, ISM-1501 requires the operating system to be replaced at every maturity level. The same requirement applies to hosts on SUSE Manager 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 to SP6 and openSUSE Leap 15.4 to 15.6, which SUSE lists as affected with no fix and groups with products past their end of life, and to Debian 11 bullseye hosts without paid third-party support: bullseye has fixed kernels (DLA-4664-1 and DLA-4671-1) but reached the end of Debian Long Term Support on 31 August 2026.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities to be obtained, the organization's exposure evaluated and appropriate measures taken. Exposure evaluation for this CVE depends on inputs a typical vulnerability register does not hold. The published scores disagree: the kernel CNA gives 8.8 with a local vector, Red Hat gives 7.5 with a network vector and high complexity, and SUSE gives 6.8 with an adjacent-network vector. Red Hat's own sources also disagree on scope: its CVE data lists the RHEL 6 kernel and the RHEL 7 kernel and kernel-rt as not affected, while its VEX file, as of 23 September 2026, lists them as affected with no fix, so the register's answer for those hosts depends on which feed it reads. Red Hat states that the flaw requires specific bridge netfilter rules, while the kernel CNA states that the rule path is reachable with namespace-local privileges through user and network namespaces, and the kernel's ebtables handler also accepts CAP_NET_ADMIN held by a container in its own network namespace. A register that records kernel package versions can match the fixed builds (RHEL 9 5.14.0-687.23.1.el9_8, SLES 15 SP7 6.4.0-150700.53.66.1, Debian bookworm 6.1.176-1, Ubuntu 26.04 7.0.0-31.31) but cannot show whether a host carries an ebtables nat rule with ARP rewrite, allows unprivileged user namespaces or runs containers granted CAP_NET_ADMIN, and each of these affects exposure."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "None of the vendor pages consulted (Red Hat, Ubuntu, SUSE, Debian) lists a live patch package for this fix. SUSE's page lists kernel-default for its Live Patching 15 SP7 product as released but names no kernel-livepatch package for this CVE. A fixed kernel therefore takes effect only after the host reboots into it. The steps that apply without a reboot are interim. Red Hat's configuration mitigation (disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces) covers only rules the administrator configures: the kernel CNA states that the rule path is reachable with namespace-local privileges through user and network namespaces, and a container or service granted CAP_NET_ADMIN in its own network namespace passes the same capability check in the kernel's ebtables handler. Blocking the ebt_snat module from loading is a general hardening step that applies to both paths; restricting user namespaces applies only to the first, and removing CAP_NET_ADMIN from containers that do not need it applies only to the second. NVD lists upstream 5.4.73 and later, 5.8.17 and later and 5.9.2 and later kernels as affected with no fixed release on those lines, Ubuntu 25.10 is end of life and was not fixed, SUSE groups the affected SUSE Manager 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 to SP6 and openSUSE Leap 15.4 to 15.6 products with products past their end of life, and CISA notes that the affected products could be end of life and advises moving to a supported version. Debian 11 bullseye has fixed kernels (DLA-4664-1 and DLA-4671-1) but reached the end of Debian Long Term Support on 31 August 2026 and receives no further Debian security updates.",
+    "affected": "The Linux kernel's bridge netfilter ebtables SNAT target (net/bridge/netfilter/ebt_snat.c). When an ebtables nat rule uses the snat target with the ARP rewrite option, the target writes the rule's MAC address over the ARP sender hardware address without first making that range of the socket buffer writable. If the range sits in a socket-buffer fragment backed by a file page imported with splice(), the six bytes are written into that file page. Red Hat rates the result as possible memory corruption, denial of service or local privilege escalation, and states that the flaw requires specific bridge netfilter rules to be configured. The kernel CNA states that the rule path requires CAP_NET_ADMIN but is reachable with namespace-local privileges through user and network namespaces, so a local user who can create those namespaces can set up the bridge and rule without init-namespace root. The kernel's ebtables rule-set handler checks CAP_NET_ADMIN against the user namespace that owns the network namespace, so a container or service granted CAP_NET_ADMIN in its own network namespace passes the same check without creating a user namespace. Distribution kernels are affected as well: RHEL 8, 9 and 10 and RHEL for NVIDIA 26; SLES and SLES for SAP Applications 15 SP4 through SP7, SLE HPC 15 SP4 and SP5 LTSS, SLE Real Time 15 SP7, SLES 16.0 and 16.1, openSUSE Leap 16.0, SUSE Liberty Linux 8 and 9, SLE Micro 5.3 through 5.5 and SUSE Linux Micro 6.0 through 6.2; Debian bullseye, bookworm and trixie; and Ubuntu 18.04 through 26.04. SUSE also lists SUSE Manager Server, Proxy and Retail Branch Server 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 through SP6 and openSUSE Leap 15.4 through 15.6 as affected with no fix, and its CVE page groups these with products past their end of life and not receiving proactive updates. Red Hat's two data sources disagree on RHEL 6 and 7: its CVE data lists the RHEL 6 kernel and the RHEL 7 kernel and kernel-rt as not affected, while its VEX file, as of 23 September 2026, lists the same kernels as affected with no fix available and applies its ebtables workaround to them. SUSE lists SLES 12 SP5 as not affected. Ubuntu lists the linux package on 18.04, 16.04 and 14.04 as not affected, but lists the 18.04 5.4-based HWE and cloud kernels (linux-hwe-5.4, linux-aws-5.4, linux-azure-5.4, linux-gcp-5.4, linux-ibm-5.4, linux-oracle-5.4 and linux-raspi-5.4) as vulnerable with no fix.",
+    "affected_versions": [
+      "Linux 5.4.73 and later 5.4.x (NVD lists no fixed release on this line)",
+      "Linux 5.8.17 and later 5.8.x, and 5.9.2 and later 5.9.x (no fixed release listed on either line)",
+      "Linux 5.10.x before 5.10.259 (5.10.259 is fixed)",
+      "Linux 5.11 up to but not including 5.15.210 (5.15.210 is fixed)",
+      "Linux 5.16 up to but not including 6.1.176 (6.1.176 is fixed)",
+      "Linux 6.2 up to but not including 6.6.143 (6.6.143 is fixed)",
+      "Linux 6.7 up to but not including 6.12.94 (6.12.94 is fixed)",
+      "Linux 6.13 up to but not including 6.18.36 (6.18.36 is fixed)",
+      "Linux 6.19 up to but not including 7.0.13 (7.0.13 is fixed)",
+      "Linux 7.1-rc1 through 7.1-rc6 (the 7.1 release is fixed)",
+      "Red Hat Enterprise Linux 9 kernel before 5.14.0-687.23.1.el9_8, and RHEL 9 Real Time and Real Time for NFV kernel-rt before 5.14.0-687.23.1.el9_8 (both fixed by RHSA-2026:36645). Red Hat's CVE data also lists a RHEL 9 kernel-rt source package as affected with no fix; RHSA-2026:36645 builds its fixed kernel-rt packages from the main kernel source package.",
+      "Red Hat Enterprise Linux 8.10 kernel before 4.18.0-553.143.1.el8_10 (fixed by RHSA-2026:39083) and kernel-rt before 4.18.0-553.143.1.rt7.484.el8_10 (fixed by RHSA-2026:39082)",
+      "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life Add-On kernel before 4.18.0-372.217.1.el8_6 (fixed by RHSA-2026:70797, issued 2026-09-23)",
+      "Red Hat Enterprise Linux 10 kernel and Red Hat Enterprise Linux for NVIDIA 26 kernel: listed as affected with no fix; Red Hat's ebtables configuration mitigation applies to both",
+      "Red Hat Enterprise Linux 7 kernel and kernel-rt, and Red Hat Enterprise Linux 6 kernel: as of 23 September 2026 Red Hat's VEX file lists them as affected with no fix available and applies its ebtables configuration mitigation to them, while Red Hat's CVE data lists them as not affected",
+      "SUSE Linux Enterprise Server 15 SP7 and SLES for SAP Applications 15 SP7 kernel-default before 6.4.0-150700.53.66.1, and SLE Real Time 15 SP7 kernel-rt before 6.4.0-150700.7.62.1; the SLES 15 SP4, SP5 and SP6 LTSS, SLES for SAP Applications 15 SP4 to SP6 and SLE HPC 15 SP4 and SP5 LTSS kernels are listed as affected with no fix",
+      "SUSE Linux Enterprise Server 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.2 kernel-default before 6.12.0-160000.36.1; SUSE lists the SLES 16.1 kernel-default as released without giving a version on its CVE page",
+      "SUSE Linux Micro 6.0 and 6.1 kernel-default before 6.4.0-49.1; SLE Micro 5.3, 5.4 and 5.5 kernels are listed as affected with no fix",
+      "SUSE Liberty Linux 8 kernel before 4.18.0-553.143.1.el8_10 (RHSA-2026:39083) and SUSE Liberty Linux 9 kernel before 5.14.0-687.23.1.el9_8 (RHSA-2026:36645), the same builds that fix RHEL 8.10 and RHEL 9",
+      "SUSE Manager Server, Proxy and Retail Branch Server 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 to SP6 and openSUSE Leap 15.4 to 15.6 kernels: listed as affected with no fix, in the group SUSE's CVE page describes as products past their end of life and not receiving proactive updates. The same page lists further affected modules and editions of the 15 SP4 to SP6 service packs.",
+      "Debian bullseye linux before 5.10.259-1 (DLA-4664-1) and linux-6.1 before 6.1.176-1~deb11u1 (DLA-4671-1); bookworm linux before 6.1.176-1 (DLA-4665-1); trixie linux before 6.12.94-1. Debian 11 bullseye reached the end of Debian Long Term Support on 31 August 2026, so DLA-4664-1 and DLA-4671-1 close this CVE, but bullseye receives no further Debian security updates.",
+      "Ubuntu 26.04 LTS linux before 7.0.0-31.31. The 26.04 kernel flavors are fixed at their own builds: linux-aws 7.0.0-1012.12, linux-azure 7.0.0-1014.14, linux-gcp 7.0.0-1011.11, linux-gke 7.0.0-1006.7, linux-ibm 7.0.0-1013.13, linux-nvidia 7.0.0-1018.18, linux-nvidia-bos 7.0.0-2018.18, linux-oem-7.0 7.0.0-1013.13, linux-oracle 7.0.0-1011.11, linux-raspi 7.0.0-1019.19, linux-realtime 7.0.0-31.31.1 and linux-riscv 7.0.0-31.31.1. The 26.04 linux-azure-fde kernel is vulnerable with no fix as of 22 September 2026. Ubuntu 25.10 is end of life and was not fixed.",
+      "Ubuntu 24.04 LTS linux package vulnerable with a fix in progress as of 22 September 2026, as are the other 24.04 kernel flavors Ubuntu lists as vulnerable; on 24.04 Ubuntu has fixed linux-hwe-7.0 in 7.0.0-31.31~24.04.1, linux-aws-7.0 in 7.0.0-1012.12~24.04.1, linux-azure-7.0 in 7.0.0-1014.14~24.04.1, linux-gcp-7.0 in 7.0.0-1011.11~24.04.1, linux-nvidia-7.0 in 7.0.0-1018.18~24.04.1, linux-riscv-7.0 in 7.0.0-31.31.1~24.04.1 and linux-nvidia-tegra in 6.8.0-1035.38",
+      "Ubuntu 22.04 LTS and 20.04 LTS kernels, and the Ubuntu 18.04 LTS 5.4-based kernels (linux-hwe-5.4, linux-aws-5.4, linux-azure-5.4, linux-gcp-5.4, linux-ibm-5.4, linux-oracle-5.4 and linux-raspi-5.4), vulnerable with no fix as of 22 September 2026; the 18.04 linux package is listed as not affected"
+    ],
+    "vendor_update_paths": [
+      "Upgrade to a kernel that contains the upstream fix, commit 67ba971ae025 (\"netfilter: bridge: make ebt_snat ARP rewrite writable\"): 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 or 7.1, then reboot into it.",
+      "On Red Hat Enterprise Linux 9, install kernel 5.14.0-687.23.1.el9_8 (RHSA-2026:36645); on RHEL 9 for Real Time or Real Time for NFV, install kernel-rt 5.14.0-687.23.1.el9_8 from the same advisory; on RHEL 8.10, install kernel 4.18.0-553.143.1.el8_10 (RHSA-2026:39083) or kernel-rt 4.18.0-553.143.1.rt7.484.el8_10 (RHSA-2026:39082); on RHEL 8.6 Advanced Mission Critical Update Support or 8.6 Extended Update Support Long-Life Add-On, install kernel 4.18.0-372.217.1.el8_6 (RHSA-2026:70797). Reboot after installing; Red Hat states that the system must be rebooted for the update to take effect.",
+      "On SUSE Linux Enterprise Server 15 SP7 and SLES for SAP Applications 15 SP7, install kernel-default 6.4.0-150700.53.66.1 or later; on SLE Real Time 15 SP7, kernel-rt 6.4.0-150700.7.62.1 or later; on SLES 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.2, kernel-default 6.12.0-160000.36.1 or later; on SUSE Linux Micro 6.0 and 6.1, kernel-default 6.4.0-49.1 or later; and on SUSE Liberty Linux 8 and 9, kernel 4.18.0-553.143.1.el8_10 (RHSA-2026:39083) or 5.14.0-687.23.1.el9_8 (RHSA-2026:36645) or later. SUSE lists the SLES 16.1 kernel-default as released without giving a version on its CVE page. Reboot after installing.",
+      "On Debian bullseye, install linux 5.10.259-1 (DLA-4664-1) or linux-6.1 6.1.176-1~deb11u1 (DLA-4671-1); on bookworm, linux 6.1.176-1 (DLA-4665-1); on trixie, linux 6.12.94-1. Reboot after installing. Debian 11 bullseye reached the end of Debian Long Term Support on 31 August 2026 and receives no further Debian security updates, so move bullseye hosts to bookworm or trixie.",
+      "On Ubuntu 26.04 LTS, install linux 7.0.0-31.31 or later, or on a flavor kernel its own fixed build or later (linux-aws 7.0.0-1012.12, linux-azure 7.0.0-1014.14, linux-gcp 7.0.0-1011.11, linux-gke 7.0.0-1006.7, linux-ibm 7.0.0-1013.13, linux-nvidia 7.0.0-1018.18, linux-nvidia-bos 7.0.0-2018.18, linux-oem-7.0 7.0.0-1013.13, linux-oracle 7.0.0-1011.11, linux-raspi 7.0.0-1019.19, or linux-realtime and linux-riscv 7.0.0-31.31.1), and reboot. The 26.04 linux-azure-fde kernel had no fix as of 22 September 2026. On Ubuntu 24.04 LTS the linux package had no fix as of that date; move to the HWE 7.0 kernel (linux-hwe-7.0 7.0.0-31.31~24.04.1 or later, or on cloud images linux-aws-7.0 7.0.0-1012.12~24.04.1, linux-azure-7.0 7.0.0-1014.14~24.04.1 or linux-gcp-7.0 7.0.0-1011.11~24.04.1), or on Tegra hosts install linux-nvidia-tegra 6.8.0-1035.38, and reboot. The Ubuntu 22.04 and 20.04 kernels and the 18.04 5.4-based kernels had no fixed package as of that date.",
+      "Where no fixed kernel is available (RHEL 10, RHEL for NVIDIA 26, the RHEL 7 kernel and kernel-rt and the RHEL 6 kernel that Red Hat's VEX file lists as affected with no fix, SLES 15 SP4 to SP6 LTSS, SLES for SAP Applications 15 SP4 to SP6, SLE HPC 15 SP4 and SP5 LTSS, SLE Micro 5.3 to 5.5, the end-of-life SUSE Manager 4.3 and LTS 4.3, SLE Real Time 15 SP4 and SP5, SLE Desktop 15 SP4 to SP6 and openSUSE Leap 15.4 to 15.6, the Ubuntu 26.04 linux-azure-fde kernel, Ubuntu 24.04 hosts that stay on the linux package or another unfixed flavor, and the Ubuntu 22.04, 20.04 and 18.04 5.4-based kernels), apply Red Hat's mitigation: disable ARP hardware address rewriting in ebtables SNAT rules (the --snat-arp option of the snat target), or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces. That change covers only rules the administrator configures. The kernel CNA states that the rule path is reachable with namespace-local privileges through user and network namespaces, and the kernel's ebtables rule-set handler checks CAP_NET_ADMIN against the user namespace that owns the network namespace, so a container or service granted CAP_NET_ADMIN in its own network namespace can also load such a rule. On hosts that do not use ebtables NAT, also add the line install ebt_snat /bin/false to a file under /etc/modprobe.d, so that modprobe runs that command instead of inserting the module, and unload the module with modprobe -r ebt_snat if it is loaded and unused. Where ebt_snat is built as a module, the block applies to both paths. In addition, where no workload on the host creates user namespaces, set the user.max_user_namespaces sysctl to 0, and remove CAP_NET_ADMIN from the containers and services that do not need it; the namespace limit does not affect a container or service that already holds CAP_NET_ADMIN. The rule change, the module block and the namespace limit take effect without a reboot, and namespaces that already exist are not removed. The module block, the namespace limit and the capability removal are general hardening steps, not vendor-published mitigations for this CVE.",
+      "Move hosts on upstream 5.4, 5.8 or 5.9 kernels to a supported kernel line that contains the fix, since NVD lists no fixed release on those lines. Move hosts on the SUSE products that SUSE groups as past their end of life to a supported SUSE release with a fixed kernel; for openSUSE Leap 15.4 to 15.6 that release is openSUSE Leap 16.0 with kernel-default 6.12.0-160000.36.1 or later."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 61,
+    "rwep_notes": "RWEP 61. cisa_kev +25, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2025-39964": {
+    "name": "Linux Kernel Race Condition Vulnerability (CVE-2025-39964)",
+    "cvss_score": 5.5,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+    "cwe_refs": [
+      "CWE-362"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-09-18",
+    "cisa_kev_due_date": "2026-09-21",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.",
+    "epss_score": 0.0079,
+    "epss_percentile": 0.54744,
+    "epss_date": "2026-09-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-39964",
+    "vendor_advisories": [
+      {
+        "vendor": "Siemens",
+        "id": "SSA-019113",
+        "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
+        "published": "2026-07-14"
+      },
+      {
+        "vendor": "Google Cloud",
+        "id": "GCP-2026-003",
+        "url": "https://docs.cloud.google.com/kubernetes-engine/security-bulletins",
+        "published": "2026-01-09"
+      },
+      {
+        "vendor": "Red Hat",
+        "id": "CVE-2025-39964",
+        "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-39964.json",
+        "published": "2025-10-13"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-39964",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    ],
+    "source_verified": "2026-09-23",
+    "last_updated": "2026-09-23",
+    "_kev_short_description": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.",
+    "type": "race-condition-kernel-lpe",
+    "blast_radius": 26,
+    "poc_available": true,
+    "poc_description": "Google's kernelCTF repository publishes an exploit at https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation (submissions exp413 and exp415), with separate exploit builds for the lts-6.12.44, mitigation-v4-6.6 and cos-121-18867.199.28 kernelCTF targets. Its metadata records a 99% success rate on each target with no separate KASLR leak, lists no required capabilities and names CONFIG_CRYPTO_USER_API as the only kernel configuration requirement. The kernelCTF vulnerability description in the same directory states that user namespaces are not required.",
+    "iocs": {
+      "behavioral": [
+        "An unprivileged process, or a process inside a container, creating an AF_ALG socket (address family 38) on a host whose baseline shows no such use. The kernelCTF submission needs only a kernel built with the AF_ALG user API, with no capabilities and no user namespace, so the process that opens the socket can be any local account or container workload. A rule that matches the socket() system call with domain 38 does not record a socket created through io_uring's IORING_OP_SOCKET operation, which kernels 5.19 and later provide. On those kernels, also alert on io_uring_setup() from processes that do not normally use io_uring, or place a kernel probe on alg_create, the AF_ALG family's create function, which runs for a socket created through either path.",
+        "Two tasks writing to the same AF_ALG socket at the same time, whether they are threads of one process or processes that share the descriptor after fork() or descriptor passing. The upstream fix sets one exclusive-write flag on the socket and rejects any second writer. Writes reach af_alg_sendmsg through sendmsg(), sendmmsg(), send(), sendto(), write() and writev(); through io_uring's IORING_OP_SENDMSG (from 5.3), IORING_OP_SEND and IORING_OP_WRITE (from 5.6) and IORING_OP_WRITEV operations; and, on kernels 6.5 and later, through splice(), sendfile() and IORING_OP_SPLICE into the socket. A system-call tracer such as auditd or Falco records the direct calls but not a write submitted through io_uring, for which it sees at most the io_uring system calls. A kernel probe on af_alg_sendmsg records writes from every one of these paths. A legitimate program that shares one AF_ALG socket between threads or processes produces the same pattern, so baseline the programs that do before alerting on it.",
+        "On a fixed kernel, writes to an AF_ALG socket failing with EBUSY. The fixed af_alg_sendmsg returns -EBUSY when another writer already holds the socket, so the error shows a second concurrent writer on that socket. A write submitted through io_uring reports the error in its completion entry rather than as a system-call return, so a system-call tracer does not record it. A legitimate program whose threads or processes share one AF_ALG socket gets the same error, so treat a burst of EBUSY failures as a lead to investigate alongside the other indicators.",
+        "A process whose effective UID changes to 0 without executing a setuid binary, su, sudo or pkexec, shortly after it opened AF_ALG sockets, or a container process reading host paths or node credentials outside its pod after the same activity."
+      ],
+      "network": [],
+      "host": [
+        "A running kernel (uname -r) inside one of the NVD affected ranges without a distribution backport of the fix: 2.6.38 up to but not including 5.10.245, 5.11 up to but not including 5.15.194, 5.16 up to but not including 6.1.154, 6.2 up to but not including 6.6.108, 6.7 up to but not including 6.12.49, 6.13 up to but not including 6.16.9, or 6.17-rc1 through 6.17-rc6. The kernel CVE record lists no fixed release for any line older than 5.10 or for the lines 5.11 to 5.14, 5.16 to 5.19, 6.0, 6.2 to 6.5, 6.7 to 6.11 and 6.13 to 6.15, so a kernel on one of those lines is affected unless its distribution backported the fix. Check the running kernel rather than the installed package, because the fix takes effect only after a reboot.",
+        "CONFIG_CRYPTO_USER_API enabled in the running kernel's configuration (/boot/config-$(uname -r) or /proc/config.gz). The kernelCTF metadata lists it as the only kernel configuration the exploit requires.",
+        "The af_alg module or algif_* modules loaded (lsmod) on a host that runs no software using the kernel crypto user API.",
+        "Kernel log entries (dmesg, journalctl -k) with a KASAN report, general protection fault or oops whose call trace names af_alg_sendmsg or another function from crypto/af_alg.c.",
+        "On Red Hat Enterprise Linux, a kernel package on RHEL 7, 8, 9 or 10, a kernel-rt package on RHEL 7 or 9, or the Red Hat Enterprise Linux for NVIDIA 26 kernel, all of which Red Hat's record lists as affected with no released fix, or a RHEL 8 kernel-rt package older than 4.18.0-553.166.1.rt7.507.el8_10, the build RHSA-2026:70403 ships.",
+        "GKE Container-Optimized OS or Ubuntu node pools below the patch versions in Google Cloud bulletin GCP-2026-003, or a GDC software for VMware, GKE on AWS or GKE on Azure cluster, for which the bulletin lists patch versions as in progress.",
+        "A Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP or SIPLUS S7-1500 CPU 1518-4 PN/DP MFP on firmware V3.1.6 or later, for which Siemens lists no fix.",
+        "A kernel.core_pattern value (sysctl kernel.core_pattern, /proc/sys/kernel/core_pattern) that the host's crash handler and configuration management did not set, especially a pipe to a program under /proc or to an executable outside the distribution's crash-handler path, and a root process started by the kernel's core-dump helper from an unexpected executable after another process crashed. The public kernelCTF exploit sources reference the kernel's core_pattern setting and /proc/self/exe. A change made through kernel memory does not pass through a write to /proc/sys/kernel/core_pattern, so compare the current value against the expected one rather than relying only on a file-write watch."
+      ],
+      "_ioc_source_note": "The AF_ALG socket-creation indicator follows the Falco rule at https://raw.githubusercontent.com/mc493/linux-kernel-zero-day-mitigation-zero-downtime-kernel-defense-/HEAD/helm/falco-rules-kernel-cve.yaml, whose condition is evt.type = socket and evt.rawarg.domain = 38. An independent repository publishes that rule, not a vendor, and it fires on every AF_ALG socket, including legitimate ones, so baseline which binaries open AF_ALG sockets before alerting on it. That rule matches only the socket() system call. The io_uring operations and the kernel versions that provide them come from the io_uring_enter(2) manual page at https://man7.org/linux/man-pages/man2/io_uring_enter.2.html, which also states that an operation's error is returned in its completion entry. The io_uring socket operation calls the same socket-creation function as socket() in the kernel source at https://raw.githubusercontent.com/torvalds/linux/v6.5/io_uring/net.c and https://raw.githubusercontent.com/torvalds/linux/v6.5/net/socket.c. Sysdig's analysis at https://www.sysdig.com/blog/detecting-and-mitigating-io-uring-abuse-for-malware-evasion states that operations issued through io_uring bypass the system calls that syscall-based security tools match, and that Falco can detect io_uring use through the io_uring_setup system call. The concurrent-write and EBUSY indicators are hunting heuristics derived from the upstream fix at https://github.com/torvalds/linux/commit/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285, which adds an exclusive write flag and returns -EBUSY from af_alg_sendmsg when another writer holds the socket. The commit gives no detection guidance, and no source consulted describes EBUSY failures as an exploitation signal. The splice() and sendfile() path on 6.5 and later kernels comes from the kernel source at the v6.5 tag (https://raw.githubusercontent.com/torvalds/linux/v6.5/crypto/af_alg.c and https://raw.githubusercontent.com/torvalds/linux/v6.5/fs/splice.c), where af_alg_sendmsg handles MSG_SPLICE_PAGES and the socket splice path used by sendfile() sends spliced pages through sock_sendmsg, and from the v6.4 tag (https://raw.githubusercontent.com/torvalds/linux/v6.4/crypto/af_alg.c), where a separate af_alg_sendpage function handles them. The route from sendmsg(), sendmmsg(), send(), sendto(), write(), writev() and the io_uring send and write operations into af_alg_sendmsg follows general Linux socket behavior rather than a statement in a source, and the kernel probes on alg_create and af_alg_sendmsg are general hunting heuristics. The capability list and the CONFIG_CRYPTO_USER_API requirement come from the kernelCTF metadata at https://raw.githubusercontent.com/google/security-research/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation/metadata.json, and the statement that user namespaces are not required comes from the kernelCTF vulnerability description at https://raw.githubusercontent.com/google/security-research/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation/docs/vulnerability.md. The exploit sources for the three kernelCTF targets, the exploit.c files under https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation/exploit, were searched for kernel interfaces and file paths rather than read in full. Each contains one socket() call, the AF_ALG and SOL_ALG constants, setsockopt() with ALG_SET_KEY, bind() and accept(), sendmsg() with ALG_SET_OP and ALG_SET_IV, one pthread_create() call and sched_setaffinity(), and references to the kernel's core_pattern setting, /proc/sys/kernel/core_pattern and /proc/self/exe; none contains io_uring, unshare() or a user or network namespace flag. The exploitation write-up in that directory was not read. The advice to compare core_pattern against its expected value, and the note on changes made through kernel memory, are general hunting heuristics. The version ranges come from the NVD record at https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-39964 and the fixed stable releases per line from the kernel CVE record at https://cveawg.mitre.org/api/cve/CVE-2025-39964. The RHEL package states and fixed build come from https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-39964.json, the GKE and GDC status from https://docs.cloud.google.com/kubernetes-engine/security-bulletins and the Siemens firmware scope from https://cert-portal.siemens.com/productcert/html/ssa-019113.html. The UID-change indicator, the loaded-module check and the kernel-log check are general hunting heuristics rather than artifacts read from a source. The network group is empty because the flaw is reached through local system calls and no source gives a network artifact for it. No actor infrastructure, file hash or C2 address is listed, because no source consulted attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The upstream fix, signed off by crypto maintainer Herbert Xu, credits Muhammad Alifa Ramdhan and Bing-Jhong Billy Jheng, both with starlabs.sg addresses, as reporters. No source consulted says AI tooling found or exploited the flaw.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2025-39964 (CWE-362, CVSS 5.5) plus the CISA KEV entry (added 2026-09-18), Google Cloud bulletin GCP-2026-003, Siemens advisory SSA-019113 and the Red Hat CVE record. The upstream fix credits Muhammad Alifa Ramdhan and Bing-Jhong Billy Jheng as reporters.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2025-39964 to the KEV catalog on 2026-09-18 with a due date of 2026-09-21, states that the addition is based on evidence of active exploitation, and records known ransomware campaign use as Unknown. The KEV entry marks forensic triage as required for this CVE, and its required action tells agencies to comply with BOD 26-04 and with CISA's Forensics Triage Requirements, both of which the entry links to. CISA's SSVC assessment in the NVD record marks exploitation as active, automatable as no and technical impact as total. CISA announced it in the same alert as CVE-2026-53266, an out-of-bounds write in the Linux kernel. No source consulted names an actor, a campaign, a targeted sector or an incident report. A public exploit is available in Google's kernelCTF repository, and its metadata records a 99% success rate on the kernelCTF LTS 6.12.44, mitigation-v4-6.6 and Container-Optimized OS 121-18867.199.28 targets.",
+    "attack_refs": [
+      "T1068",
+      "T1611",
+      "T1499.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires the organization to identify, report and correct system flaws and to install security-relevant updates within an organization-defined time period of their release. Programs usually set that period from severity, and the severity labels for this CVE disagree: NVD scores it 5.5 with availability impact only and Red Hat rates it Moderate, while the kernel CNA scores it 7.8 and Google's bulletin GCP-2026-003 rates it High as a privilege escalation on Container-Optimized OS nodes. Red Hat's CVE page also flags the CVE as having known public exploits and tells customers to address it with high priority, a flag recorded separately from its Moderate rating. A time period keyed only to the NVD base score or to a vendor severity label puts the AF_ALG fix in a medium-severity queue although CISA lists it as exploited and a public kernelCTF exploit reports a 99% success rate.",
+      "NIST-800-53-SC-39": "SC-39 requires a separate execution domain for each executing process, and on a container host the kernel's namespaces and cgroups provide those domains. This flaw is in the kernel that enforces them: the kernelCTF metadata lists no required capabilities and only CONFIG_CRYPTO_USER_API as kernel configuration, the kernelCTF vulnerability description states that user namespaces are not required, and Google lists both GKE Standard and Autopilot clusters as impacted and exempts only clusters using GKE Sandbox. SC-39 evidence based on per-container namespaces stays compliant while any workload on an unpatched node can open an AF_ALG socket and attack the host kernel.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) requires essential and important entities to include vulnerability handling in the maintenance of their network and information systems. An entity running Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP or SIPLUS S7-1500 CPU 1518-4 PN/DP MFP controllers has no fix to apply for this CVE: Siemens SSA-019113 lists every firmware version from V3.1.6 as affected with no fix available, and its V3.1.7 update covers other CVEs only. Handling is limited to the two mitigations Siemens publishes, and Article 21 does not define a handling state for an exploited flaw that stays unfixed with only compensating measures in place.",
+      "UK-CAF-B4": "Principle B4 expects the systems that support an essential function to be securely configured and their known vulnerabilities to be managed. For the RHEL kernels Red Hat still lists as affected, Red Hat states that no mitigation meets its criteria, and the kernelCTF description leaves its syscall-to-disable field empty, so no vendor-published interim configuration exists for a B4 assessment to check. The factors that decide exposure are whether the kernel is built with the AF_ALG user API and whether untrusted local users or containers run on the host, and B4 does not name either as a vulnerability-management question.",
+      "AU-Essential-8-Patch": "The Essential Eight treats the Linux kernel as an operating system. On internet-facing servers, ISM-1877 requires the fix within 48 hours of release at every maturity level when the vendor rates the flaw critical or a working exploit exists, and ISM-1694 allows two weeks when the vendor rates it non-critical and no working exploit exists. A working exploit exists here, because CISA lists the flaw in KEV and the kernelCTF repository publishes one. On workstations and non-internet-facing servers, such as internal Kubernetes nodes and shared build hosts, ISM-1695 allows one month at Maturity Levels One and Two, and only at Maturity Level Three does ISM-1696 require 48 hours when the vendor rates the flaw critical or a working exploit exists. The flaw needs local code execution rather than network reach, so the internet-facing split does not follow the exposure: a container tenant on an internal node has the access the exploit needs. Every window starts at the vendor's release, and Red Hat's record lists only a RHEL 8 kernel-rt fix, so for the other RHEL kernels no window has started.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use be obtained, the organization's exposure evaluated and appropriate measures taken. For this CVE the exposure evaluation depends on which kernel build carries the fix: upstream fixed it in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9 and 6.17, Red Hat's RHEL 8 kernel-rt fix is 4.18.0-553.166.1.rt7.507.el8_10, and GKE fixes it only at specific node versions. On Siemens S7-1500 MFP CPUs the affected kernel is part of the firmware's additional GNU/Linux subsystem, so an asset register that records only the controller firmware version does not show that the controller contains an exploited Linux kernel flaw."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No source consulted documents a live patch for this fix, so remediation is a kernel update followed by a host reboot into the fixed kernel. A fix exists upstream and for some downstream builds, but not for all of them: Red Hat's record lists RHSA-2026:70403 for RHEL 8 kernel-rt as its only released fix, and Siemens lists no fix for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP firmware.",
+    "affected": "The Linux kernel's AF_ALG user-space crypto interface (crypto/af_alg.c) in kernels built with CONFIG_CRYPTO_USER_API, from 2.6.38 until the stable fixes. A local unprivileged process can use it to crash the host, and Google's GKE bulletin and the kernelCTF exploits show privilege escalation to the kernel, which on a shared container node crosses the container boundary. Affected downstream builds include the RHEL 7, 8, 9 and 10 kernels, GKE Container-Optimized OS and Ubuntu node images, and the additional GNU/Linux subsystem of the Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and its SIPLUS variant. Google's bulletin lists patch versions and a severity assessment for GDC software for VMware, GKE on AWS and GKE on Azure as in progress, and lists GDC software for bare metal as not affected because it does not bundle an operating system.",
+    "affected_versions": [
+      "Linux kernel 2.6.38 up to but not including 5.10.245 (5.10.245 is fixed). This range includes every stable line older than 5.10, for which the kernel CVE record lists no fixed release.",
+      "Linux kernel 5.11 up to but not including 5.15.194 (5.15.194 is fixed). The kernel CVE record lists no fixed release for the 5.11 to 5.14 lines in this range.",
+      "Linux kernel 5.16 up to but not including 6.1.154 (6.1.154 is fixed). The kernel CVE record lists no fixed release for the 5.16 to 5.19 and 6.0 lines in this range.",
+      "Linux kernel 6.2 up to but not including 6.6.108 (6.6.108 is fixed). The kernel CVE record lists no fixed release for the 6.2 to 6.5 lines in this range.",
+      "Linux kernel 6.7 up to but not including 6.12.49 (6.12.49 is fixed). The kernel CVE record lists no fixed release for the 6.7 to 6.11 lines in this range.",
+      "Linux kernel 6.13 up to but not including 6.16.9 (6.16.9 is fixed). The kernel CVE record lists no fixed release for the 6.13 to 6.15 lines in this range.",
+      "Linux kernel 6.17-rc1 through 6.17-rc6 (6.17 is fixed)",
+      "Red Hat Enterprise Linux 8 kernel-rt before 4.18.0-553.166.1.rt7.507.el8_10 (fixed by RHSA-2026:70403, released 2026-09-22). Red Hat's record lists the RHEL 7, 8, 9 and 10 kernel packages, the RHEL 7 and 9 kernel-rt packages and Red Hat Enterprise Linux for NVIDIA 26 as affected with no released fix, and RHEL 6 as not affected.",
+      "GKE Container-Optimized OS node pools below 1.34.1-gke.3556000, 1.33.5-gke.1862000, 1.32.9-gke.1239000, 1.31.13-gke.1139000, 1.30.14-gke.1719000, 1.29.15-gke.2467000 or 1.28.15-gke.3163000 on the matching minor version (each listed version is fixed). Clusters using GKE Sandbox are not impacted.",
+      "GKE Ubuntu node pools below 1.35.1-gke.1396000, 1.34.4-gke.1047000, 1.33.8-gke.1026000, 1.32.12-gke.1026000, 1.31.14-gke.1336000 or 1.30.14-gke.1991000 on the matching minor version (each listed version is fixed).",
+      "GDC software for VMware, GKE on AWS and GKE on Azure: Google Cloud bulletin GCP-2026-003 lists patch versions and a severity assessment for each as in progress, with the status Pending. The same bulletin lists GDC software for bare metal as not affected because it does not bundle an operating system.",
+      "Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0, 6ES7518-4AX00-1AC0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0, 6ES7518-4FX00-1AC0) and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0): all firmware versions from V3.1.6, in the additional GNU/Linux subsystem. Siemens lists no fix for this CVE; the V3.1.7 update in the same advisory fixes other CVEs and does not fix this one."
+    ],
+    "vendor_update_paths": [
+      "Upgrade to a kernel that carries upstream commit 1b34cbbf4f01, which disallows concurrent writes in af_alg_sendmsg, or its stable backport: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 or later on the matching stable line. A kernel on a line for which the kernel CVE record lists no fixed release (every line older than 5.10, and lines such as 5.14, 6.0 or 6.8) has no fixed build on its own line: move it to a fixed stable line, or install a distribution kernel that backports commit 1b34cbbf4f01. On a host in scope for forensic triage (under BOD 26-04, a federal agency's publicly exposed asset), or on any host where untrusted local users or containers ran code on a vulnerable kernel, capture memory, running processes and kernel logs before installing the update, because the reboot clears memory and CISA's triage guidance says patching may jeopardize the availability of artifacts. Reboot into the new kernel, because the fix takes effect only in the running kernel.",
+      "On Red Hat Enterprise Linux 8 with kernel-rt, capture memory, running processes and kernel logs first on a host in scope for forensic triage, then install kernel-rt 4.18.0-553.166.1.rt7.507.el8_10 or later from RHSA-2026:70403 and reboot. For the other RHEL kernel packages, Red Hat's record lists no released fix and states that no mitigation meets its criteria, so follow the Red Hat CVE record for the erratum.",
+      "On GKE, capture memory, running processes and kernel logs first from any node in scope for forensic triage, then upgrade Container-Optimized OS and Ubuntu node pools to the patch versions listed in Google Cloud bulletin GCP-2026-003 or later. Clusters using GKE Sandbox are listed as not impacted. For GDC software for VMware, GKE on AWS and GKE on Azure, the bulletin lists patch versions as in progress, so follow the bulletin for the fixed versions. GDC software for bare metal is listed as not affected, and the bulletin states that no action is required for it.",
+      "On Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP controllers, SSA-019113 lists no fix for this CVE. Apply the Siemens mitigations: build and run applications only from trusted sources, and limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel.",
+      "On other distributions, capture memory, running processes and kernel logs first on a host in scope for forensic triage or on any host where untrusted local users or containers ran code on a vulnerable kernel, then install the vendor kernel update that backports the upstream fix, reboot, and confirm with uname -r that the fixed kernel is the one running."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 26,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 81,
+    "rwep_notes": "RWEP 81. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +26, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2026-7273": {
+    "name": "Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability",
+    "cvss_score": 8.8,
+    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-121"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-09-21",
+    "cisa_kev_due_date": "2026-09-24",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.",
+    "epss_score": 0.01987,
+    "epss_percentile": 0.7972,
+    "epss_date": "2026-09-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-7273",
+    "vendor_advisories": [
+      {
+        "vendor": "Zyxel",
+        "advisory_id": "zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026",
+        "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026",
+        "severity": "unknown",
+        "published_date": null
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-7273",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026"
+    ],
+    "source_verified": "2026-09-23",
+    "last_updated": "2026-09-23",
+    "_kev_short_description": "Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.",
+    "type": "stack-buffer-overflow-to-os-command-execution",
+    "blast_radius": 16,
+    "poc_available": false,
+    "poc_description": "No working exploit code is obtainable at a nameable public location. The GreyNoise report quotes fragments of the attacker's command-line interface for CVE-2026-7273 (its description string 'Zyxel GS1900 Pre-Auth RCE', usage examples issued over http:// and https://, and its GOT and stack mode options) but does not host runnable code. NVD tags the GreyNoise reference 'Exploit', but the linked page is a summary rather than a hosted exploit. The 0xMarcio pocindex aggregator records 'No PoCs found on GitHub currently.' for this CVE. The campaign's own exploit was a private, PyArmor-obfuscated Python script that GreyNoise did not publish, so no Exploit-DB id, Metasploit module, nuclei template or public repository hosts a working exploit.",
+    "iocs": {
+      "behavioral": [
+        "After a crafted request to the switch web management CGI, the switch fetches a file over TFTP and runs it with the shell: GreyNoise documents the exploit issuing a TFTP get of a file named c saved as /1, then executing /bin/sh /1.",
+        "The switch stages collected data for retrieval by copying /tmp/info to the web-reachable path /home/web/tmp/info.txt, the collector step GreyNoise documents.",
+        "Hunting heuristic: the switch web management CGI process starting a shell that runs tftp against a host that is not an approved TFTP server, or that runs a fetched script such as /1; the exploit commands GreyNoise documents follow this pattern. Administrators also upgrade firmware from a TFTP server and upload configuration backups to one through the web interface, so a rule compares each shell and transfer against those functions and the approved TFTP servers instead of alerting on every process the web interface starts.",
+        "The switch opening an unexpected listening service, for example a busybox telnet daemon on port 2323 bound to /bin/sh, which appears as a usage example in the exploit's command-line interface."
+      ],
+      "network": [
+        "Crafted requests to the switch web management CGI over HTTP or HTTPS from any host outside the management network; the exploit's usage examples target the interface at 192.168.1.1 over both HTTP and HTTPS, and its GOT mode succeeds with a single request while its stack mode sends many.",
+        "A burst of requests to the web management CGI from one source, on the order of hundreds to thousands, matching the exploit's stack mode (ASLR brute force, about 2,048 requests on average).",
+        "Outbound TFTP from the switch to a host that is not an approved TFTP server, on any port including the 6969 the campaign used; the switch supports TFTP only for firmware upgrade and configuration backup or restore, so a transfer to an unknown host is anomalous."
+      ],
+      "host": [
+        "GS1900 firmware at or below the affected build for the model (for example GS1900-24 at or below 2.90(AAHL.1)C0, or GS1900-48HPv2 at or below 2.90(ABTQ.1)C0), the vulnerable state per the Zyxel advisory.",
+        "Staging files the observed collector leaves: /tmp/info and its web-reachable copy /home/web/tmp/info.txt, and a fetched script written as /1 and executed by /bin/sh.",
+        "The switch carrying factory-default administrator credentials, an exposure condition present on 564 of the 996 compromised switches rather than a compromise artifact."
+      ],
+      "campaign_actor_wide": [
+        "Backdoor file SHA-256 hashes GreyNoise lists for the actor's broader operation: 0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f, 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 and 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1. GreyNoise reports that the last was delivered to targets in the actor's first round of Ubiquiti exploitation, and it does not tie any of the three to the switch intrusions.",
+        "Actor infrastructure from GreyNoise's indicator table: the command-and-control domain pattern *.981666.xyz, staging host 74.48.66.73, command-and-control host 104.225.153.141, and two exploitation hosts, 172.245.247.21 and a second host the report redacts. GreyNoise does not say which direction traffic to the two exploitation hosts ran, and it redacts the host the switches fetched the collector script from, so match every listed actor address as both a source and a destination.",
+        "Account names kapibala and kapibala2, which GreyNoise's indicator table lists as accounts. The report shows both in the actor's WordPress and Windows activity and does not tie either to the switch intrusions. kapibala2 is a local Windows administrator account that the actor's PowerShell script created through the .NET System.DirectoryServices.AccountManagement API; the script was written to C:\\Windows\\Temp\\imp.ps1 and run with powershell.exe -NoProfile -ep bypass -File, and the actor then checked the account with net user kapibala2. The account was not created with a net user /add command, so a hunt for that command misses it. The string kapibala also names the actor's WordPress plugin directory, /wp-content/plugins/kapibala_plugin/, whose kapibala_index.php the actor's scripts address as the webshell."
+      ],
+      "_ioc_source_note": "The switch-specific artifacts (the TFTP fetch of a file named c run as /bin/sh /1, the /tmp/info and /home/web/tmp/info.txt staging paths, and the theft of configurations, hashed root-level credentials and networking information from 996 switches in 48 countries with 564 on factory-default credentials) come from the GreyNoise report at https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation. GreyNoise attributes the campaign to an unnamed malicious cyber actor it assesses as the same as or related to the actor Acronis reported as Red Heron. The report redacts the TFTP host used against the switches and does not tie any published hash, domain, IP or account name to the switch intrusions; those indicators, listed under campaign_actor_wide, belong to the actor's broader operation, and the report does not give the traffic direction for the two exploitation hosts. The affected firmware builds come from the Zyxel advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026, which carries no indicators of compromise. The HTTP and HTTPS request pattern, the stack-mode request volume and the TFTP-to-unapproved-host entries are read from the exploit behavior GreyNoise documents; the shell-from-CGI and unexpected-telnet-listener behaviors and the factory-default-credential condition are hunting heuristics or an exposure condition rather than per-switch artifacts the report lists. The administrator TFTP firmware-upgrade and configuration-backup functions, which a rule compares the shell heuristic against, come from ManualsLib copies of Zyxel's GS1900 Series User's Guide at https://www.manualslib.com/manual/1116578/Zyxel-Communications-Gs1900-Series.html?page=214 and https://www.manualslib.com/manual/2489138/Zyxel-Communications-Gs1900-Series.html?page=234."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The Zyxel advisory credits Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo from ISCAS for reporting the flaw. No source says AI tooling was used to find it. Separately, GreyNoise states it did not identify any specific AI tools in the attacking operation but suspects a large language model helped generate the actor's custom tooling; that is an unconfirmed suspicion about weaponization, not about discovery.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Compiled from NVD CVE-2026-7273 (CWE-121, CVSS 8.8) + CISA KEV (added 2026-09-21) + Zyxel security advisory for the GS1900 series stack-based buffer overflow (06-16-2026), which credits Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo from ISCAS for reporting the issue.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2026-7273 to the KEV catalog on 2026-09-21 with a 2026-09-24 due date and records known ransomware use as Unknown; the required action cites CISA's BOD 26-04 and its forensics triage requirements. NVD's SSVC decision records exploitation as active with total technical impact. GreyNoise reported on 2026-09-21 that on or about 17 August 2026 an unnamed malicious cyber actor, which it assesses as the same as or related to the actor Acronis reported as Red Heron, exploited the flaw and exfiltrated configurations, hashed root-level credentials and networking information from 996 GS1900 switches across 48 countries, and that 564 of those switches carried factory-default credentials. As of 17 September 2026 GreyNoise called this the first publicly documented in-the-wild exploitation. The exploit was a private PyArmor-obfuscated Python script; GreyNoise suspected but did not confirm large-language-model assistance in building the actor's tooling.",
+    "attack_refs": [
+      "T1190",
+      "T1059.004",
+      "T1105",
+      "T1602.002",
+      "T1552.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires installing security-relevant firmware updates within an organization-defined time period of their release, which for this CVE means upgrading each GS1900 model to its fixed build (for example GS1900-24 to 2.90(AAHL.2)C0 and GS1900-48HPv2 to 2.90(ABTQ.2)C0). SI-2 sets no maximum for that period. Zyxel released the fix on 2026-06-16, so an organization that set a period of 62 days or more, such as a 90-day cycle ending about 2026-09-14, could still have been running vulnerable firmware when the exploitation began on or about 2026-08-17. The SI-2 discussion allows the period to vary with the threat environment but does not require a shorter period once exploitation is confirmed; for this CVE that matters only for a switch still unpatched when CISA listed the flaw on 2026-09-21, because the campaign came before the listing.",
+      "NIS2-Art21-network-security": "Article 21(2) requires appropriate and proportionate technical measures for the security of network and information systems, but it sets no accelerated response tier tied to CISA KEV status or confirmed exploitation for a pre-authentication operating-system-command-execution flaw on a managed switch, and it does not require that the switch web management interface be unreachable from the internet or from the user segments the switch serves. An operator can attest Article 21 compliance while a GS1900 management interface is reachable from the internet, which is the exposure the campaign used to exploit 996 switches across 48 countries.",
+      "UK-CAF-B4": "CAF principle B4 requires that announced vulnerabilities be tracked and prioritized and that externally exposed ones be mitigated promptly, and its guidance names both a separate management layer on dedicated equipment and the removal or credential change of default and built-in accounts. B4 does not define promptly, and its partially-achieved tier lets vulnerabilities that are not externally exposed carry temporary mitigations for an extended period. Zyxel rated CVE-2026-7273 a LAN-based flaw (CVSS AV:A), which invites classifying a switch management interface as not externally exposed and applying that slower tier, even though GreyNoise showed the interface accessible from the internet and exploited remotely on 996 switches.",
+      "AU-Essential-8-Patch": "The Essential Eight patches the operating systems of network devices within timeframes set by exposure and maturity level. For an internet-facing network device, its operating system is patched within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1877), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694), at every maturity level. For a network device that is not internet-facing, its operating system is patched within one month at Maturity Levels One and Two (ISM-1695); at Maturity Level Three it is patched within 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696) and within one month when the vendor rates it non-critical and no working exploit exists (ISM-1902). Zyxel released the fix on 2026-06-16 and rated CVE-2026-7273 8.8 High, and CISA's SSVC assessment on that date recorded exploitation as none, so the slower windows applied: two weeks, to 2026-06-30, for an internet-facing switch, and one month, to 2026-07-16, for an internal one. At every maturity level the applicable window closed four and a half to seven weeks before the exploitation that began on or about 2026-08-17, so meeting it would have put the fixed firmware on each switch before the campaign began. The remaining limit applies to a switch that missed its window: for a switch still unpatched on 2026-08-17, the patch controls are met once the update is installed and do not require a compromise assessment, evidence collection, or rotation of the configuration secrets and hashed credentials the campaign exfiltrated. For a GS1900 model past Zyxel's end of vulnerability support, such as the version 1 GS1900-24HP or GS1900-48HP, Zyxel's advisory lists no fixed build, and at every maturity level the Essential Eight requires an operating system that its vendor no longer supports to be replaced (ISM-1501), which removes such a unit rather than leaving it exposed without a fix.",
+      "ISO-27001-2022-A.8.8": "A.8.8 technical vulnerability management depends on the asset register recording that each GS1900 switch is present and carrying its firmware build. Where these access switches appear as generic network hardware without a firmware build, the affected-build boundary for each model (for example GS1900-48HPv2 at or below 2.90(ABTQ.1)C0) cannot be evaluated, and A.8.8's undefined appropriate timescales default to a routine cycle rather than the hours-scale response a KEV-listed, actively exploited pre-authentication flaw warrants."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "There is no reload-free path for this fix. Remediation is flashing the fixed firmware build for the model, which restarts the switch. No source documents a live-patch or hotpatch mechanism for GS1900 firmware. For CVE-2026-7273, Zyxel released fixed builds only for models within their vulnerability support period. The version 1 GS1900-24HP and GS1900-48HP are end of life: Zyxel's archived end-of-life table gives 2021-01-30 as the end of vulnerability support for both, and this advisory neither patches them nor lists them as unaffected. The advisory lists no fix for those units, so their remediation is restricting the management interface and replacing the switch.",
+    "affected": "Zyxel GS1900 series smart managed switches. A stack-based buffer overflow in the web management CGI program allows an unauthenticated attacker who can reach the switch web management interface over HTTP or HTTPS to run operating-system commands on the switch through a crafted request, exposing the device configuration, the local hashed credential store and networking information. The CVSS vector rates the attack vector as adjacent (AV:A), but the observed campaign exploited internet-exposed management interfaces on 996 switches across 48 countries, so any host that can reach the interface, including one on the internet where it is exposed, can exploit the flaw. Zyxel released patches only for the affected models still within their vulnerability support period, and its statement that products not listed in its advisory are unaffected covers only on-market products. The version 1 GS1900-24HP and GS1900-48HP, which Zyxel's 2021 GS1900 advisory for CVE-2021-35030 listed alongside the GS1900-24HPv2 and GS1900-48HPv2, are past Zyxel's end of vulnerability support and are neither patched nor declared unaffected by this advisory. Whether they are vulnerable to CVE-2026-7273 is undetermined, the advisory lists no fix for them, and an owner should treat them as potentially vulnerable.",
+    "affected_versions": [
+      "GS1900-8 firmware through 2.90(AAHH.1)C0 (fixed in 2.90(AAHH.2)C0)",
+      "GS1900-8HP firmware through 2.90(AAHI.1)C0 (fixed in 2.90(AAHI.2)C0)",
+      "GS1900-10HP firmware through 2.90(AAZI.1)C0 (fixed in 2.90(AAZI.2)C0)",
+      "GS1900-16 firmware through 2.90(AAHJ.1)C0 (fixed in 2.90(AAHJ.2)C0)",
+      "GS1900-24 firmware through 2.90(AAHL.1)C0 (fixed in 2.90(AAHL.2)C0)",
+      "GS1900-24E firmware through 2.90(AAHK.1)C0 (fixed in 2.90(AAHK.2)C0)",
+      "GS1900-24EP firmware through 2.90(ABTO.1)C0 (fixed in 2.90(ABTO.2)C0)",
+      "GS1900-24HPv2 firmware through 2.90(ABTP.1)C0 (fixed in 2.90(ABTP.2)C0)",
+      "GS1900-48 firmware through 2.90(AAHN.1)C0 (fixed in 2.90(AAHN.2)C0)",
+      "GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0 (fixed in 2.90(ABTQ.2)C0)"
+    ],
+    "vendor_update_paths": [
+      "Before changing an exploited or suspect switch, collect evidence: export the running, startup and backup configurations and the flash and buffer logs through Maintenance > Configuration > Backup (the switch erases logs held in its memory buffer when it reboots), preserve the staging files (/tmp/info, /home/web/tmp/info.txt and any fetched /1) and check for compromise, because CISA's BOD 26-04 forensics triage guidance at https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk states to collect all required evidence before patching, as patching may jeopardize the availability of artifacts.",
+      "Update each affected switch to the fixed firmware build for its model per the Zyxel advisory (for example GS1900-24 to 2.90(AAHL.2)C0 and GS1900-48HPv2 to 2.90(ABTQ.2)C0): upload the fixed image, set it as the active image, reboot the switch, and confirm the running version on the System Info screen. Then upload the same fixed build to the other image partition, because the switch boots the backup image when the active partition has problems during boot, and a backup partition that still holds an affected build would return the switch to vulnerable firmware.",
+      "For a GS1900 model outside Zyxel's vulnerability support period, such as the version 1 GS1900-24HP or GS1900-48HP, Zyxel's advisory for this CVE lists no fixed build and does not state that the model is unaffected: restrict its web management interface to a dedicated management network, then replace the switch with a supported model.",
+      "Remove the switch web management interface from the internet and restrict it to a dedicated management network, using the switch's Remote Access Control profiles or a management VLAN that user and adjacent segments cannot reach, since any host that can reach the interface can exploit the flaw without authentication.",
+      "Change factory-default administrator credentials and rotate the local credentials and any shared secrets held on the switch (SNMP, and any RADIUS, TACACS+ or shared keys), because the observed campaign exfiltrated the switch configuration and hashed credentials and 564 victim switches were on factory-default credentials.",
+      "For a switch that was exploited or may have been, compare its startup and backup configurations against a known-good copy made before the compromise, or reset the switch to factory defaults and rebuild its configuration, before returning it to service. The firmware update writes a new firmware image to a flash partition and leaves the startup and backup configurations on the switch, so an account, SNMP community, access rule or other setting an attacker saved to them remains after the update."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 16,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 51,
+    "rwep_notes": "RWEP 51. cisa_kev +25, active_exploitation +20, blast_radius +16, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2025-39682": {
+    "name": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-754"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-09-18",
+    "cisa_kev_due_date": "2026-09-21",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.",
+    "epss_score": 0.0203,
+    "epss_percentile": 0.80179,
+    "epss_date": "2026-09-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-39682",
+    "vendor_advisories": [
+      {
+        "vendor": "Red Hat",
+        "id": "CVE-2025-39682",
+        "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-39682.json",
+        "published": "2025-09-05"
+      },
+      {
+        "vendor": "Debian",
+        "id": "DSA-6008-1",
+        "url": "https://security-tracker.debian.org/tracker/DSA-6008-1",
+        "published": "2025-09-22"
+      },
+      {
+        "vendor": "Debian",
+        "id": "DSA-6009-1",
+        "url": "https://security-tracker.debian.org/tracker/DSA-6009-1",
+        "published": "2025-09-22"
+      },
+      {
+        "vendor": "Debian",
+        "id": "DLA-4328-1",
+        "url": "https://security-tracker.debian.org/tracker/DLA-4328-1",
+        "published": "2025-10-13"
+      },
+      {
+        "vendor": "SUSE",
+        "id": "SUSE-SU-2026:0202-1",
+        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260202-1/",
+        "published": "2026-01-21"
+      },
+      {
+        "vendor": "SUSE",
+        "id": "SUSE-SU-2026:0283-1",
+        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260283-1/",
+        "published": "2026-01-23"
+      },
+      {
+        "vendor": "Siemens",
+        "id": "SSA-032379",
+        "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
+        "published": "2026-05-12"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2025-39682",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    ],
+    "source_verified": "2026-09-23",
+    "last_updated": "2026-09-23",
+    "_kev_short_description": "Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
+    "type": "ktls-record-type-check-bypass-kernel",
+    "blast_radius": 22,
+    "poc_available": true,
+    "poc_description": "Google's google/security-research repository on GitHub publishes kernelCTF exploits for this CVE at https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39682_lts_cos_mitigation. The directory's metadata file lists exploits for three kernelCTF targets, lts-6.12.40, mitigation-v4-6.6 and cos-121-18867.90.97 (a Container-Optimized OS build), each with a stated 99% success rate. It names CONFIG_TLS as the only kernel configuration the exploits need and lists no required capabilities and no required attack surface. kernelCTF's rules describe its exploit test as local privilege escalation and flag retrieval. The exploit code was added in pull request #251, which was opened on 2025-09-22 and merged into the master branch on 2026-02-25. The three exploit.c sources were searched for the kernel interfaces and file paths they use, which the indicators record, rather than read in full. The NVD record carries no reference tagged Exploit.",
+    "iocs": {
+      "behavioral": [
+        "A process, including one started by an unprivileged local user, that does not normally use kernel TLS attaching the tls upper-layer protocol to a TCP socket (setsockopt with SOL_TCP and the TCP_ULP option set to tls) and then installing a receive key with the TLS_RX socket option, whether on a socket it accepted as a server or on one it opened as a client. Few processes on a typical host do this, so an unfamiliar process, or one running inside a container, is worth review on an unpatched kernel.",
+        "Kernel warnings, oops reports, panics, KASAN use-after-free or double-free reports, and slab or list-corruption reports whose call trace runs through the kernel TLS code (net/tls), on a host running a kernel in an affected range, whether the trace is in the recvmsg() path (process_rx_list, skb_copy_datagram_msg), in the TLS strparser as data arrives (tls_strp_load_anchor_with_queue, skb_fill_page_desc) or at socket teardown. The Linux kernel CNA's record describes the flaw's effect as a use-after-free and double free of the strparser's anchor buffer and of TCP receive-queue buffers: incoming data is written into the freed buffer, socket teardown frees the anchor and its frag_list buffers twice, and the slab corruption produces oopses, panics and list corruption.",
+        "A process that recently set up kernel TLS receive sockets gaining root privileges or changing credentials shortly afterward, or repeated crashes and restarts of a process that uses kernel TLS, on an unpatched host.",
+        "A process that opens a TCP connection to itself over the loopback interface, attaches the tls upper-layer protocol with a TLS 1.2 receive key on one end, and uses splice() with pipes on that connection. The public kernelCTF exploit sources contain INADDR_LOOPBACK, listen(), connect() and accept() alongside the TCP_ULP and TLS_RX socket options and splice() and pipe() calls, which indicates a connection the exploit opens to itself, so a network sensor records nothing and the host-side setsockopt, splice and /proc/net/tls_stat signals are the ones that apply."
+      ],
+      "network": [
+        "Inbound TLS connections from untrusted or internet clients to a server process that enables kernel TLS receive on the accepted socket, on an unpatched host. The Linux kernel CNA's record states that an anonymous client completing a server-authenticated TLS handshake with a kTLS server is enough to reach the flaw.",
+        "Outbound TLS connections from an unpatched host to untrusted or unexpected servers where the client side enables kernel TLS receive, such as OpenSSL with kTLS, NFS-over-TLS, or SMB/RPC over TLS through the kernel's net/handshake interface, the consumers the Linux kernel CNA's record names. The record states that a malicious server that a kTLS client connects to is enough, and Red Hat's only condition for remote triggering is that kernel TLS is in use, so hosts that use kernel TLS only as clients are exposed as well as servers.",
+        "Where a sensor can read TLS record headers: a peer sending a zero-length record of a type other than application data (an alert or handshake record, for example) between two application-data records on a connection to or from a kernel TLS host, the data, zero-length non-data, data sequence the Linux kernel CNA's record describes. On TLS 1.2 the record type and length travel in the clear, so a passive sensor without the session keys can see a non-data record of the smallest ciphertext size the cipher suite produces, and RFC 5246 does not allow a legitimate peer to send zero-length alert, handshake or ChangeCipherSpec records. On TLS 1.3 every record carries the outer type application data and the real type is known only after decryption, so the sequence is visible only to a sensor that holds the session keys or terminates the connection."
+      ],
+      "host": [
+        "On upstream stable and mainline builds only, a running kernel (uname -r) inside NVD's affected ranges: 6.0 up to but not including 6.1.149, 6.2 up to but not including 6.6.103, 6.7 up to but not including 6.12.44, 6.13 up to but not including 6.16.4, or the 6.17-rc1 and 6.17-rc2 release candidates. Distribution kernels are checked by installed package version, or on Container-Optimized OS by image build, against the distributor's fixed build, as in the items below, because their uname -r string can fall inside these ranges after the fix. Debian releases before Debian 13 set the third component of the kernel's ABI name to 0, so a patched Debian 12 kernel still reports 6.1.0 in uname -r.",
+        "Red Hat Enterprise Linux 9 or 10, or SUSE Liberty Linux 9, running a kernel older than the build Red Hat lists as fixed for its stream (kernel-0:5.14.0-570.49.1.el9_6, kernel-0:5.14.0-427.96.1.el9_4, kernel-0:5.14.0-284.144.1.el9_2, kernel-rt-0:5.14.0-284.144.1.rt14.429.el9_2 or kernel-0:6.12.0-55.37.1.el10_0), including hosts that installed the fixed package but have not rebooted into it. A version check against NVD's 6.0 lower bound misses these RHEL 9 and Liberty Linux 9 kernels, which report 5.14.0.",
+        "SUSE hosts running a kernel older than the fixed build SUSE lists for the host's product and kernel flavor, compared by installed package version rather than by uname -r: kernel-default 6.4.0-150600.23.73.1 on SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise Desktop 15 SP6 and openSUSE Leap 15.6; kernel-default 6.4.0-150700.53.19.1 on SUSE Linux Enterprise Server 15 SP7, SUSE Linux Enterprise Server for SAP Applications 15 SP7 and SUSE Linux Enterprise Desktop 15 SP7; kernel-rt 6.4.0-150600.10.55.1 on SUSE Linux Enterprise Real Time 15 SP6 and openSUSE Leap 15.6, and kernel-rt 6.4.0-150700.7.19.1 on SUSE Linux Enterprise Real Time 15 SP7; kernel-azure 6.4.0-150600.8.52.1 on 15 SP6 and openSUSE Leap 15.6, and kernel-azure 6.4.0-150700.20.15.2 on 15 SP7; kernel-coco 6.4.0-15061.32.coco15sp6.1 from the SUSE Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6; kernel-default 6.12.0-160000.6.1 on SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.2, with kernel-rt at the same version on openSUSE Leap 16.0 and SUSE Linux Micro 6.2; and kernel-default 6.4.0-35.1 or kernel-rt 6.4.0-37.1 on SUSE Linux Micro 6.0 and 6.1. SUSE's status table marks the kernel-source-azure package on SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0 and openSUSE Leap 16.0 as Affected and lists no fixed kernel-azure build for those releases, so a 16.0 host running kernel-azure counts as unfixed until SUSE lists one. SUSE lists the SUSE Linux Enterprise Server 16.1 GA kernels, kernel-default and kernel-azure 6.12.0-160099.45.1, as fixed. SUSE numbers its kernel-rt, kernel-azure and kernel-coco builds separately from kernel-default, so each host is compared with the build for the flavor it runs. SUSE's 6.4.0 and 6.12.0 kernels fall inside NVD's 6.2 to 6.6.103 and 6.7 to 6.12.44 ranges whether or not they are patched. A host counts as fixed only after it has rebooted into the fixed kernel, or when the kernel-livepatch package SUSE lists for this CVE for its running kernel is installed, for example kernel-livepatch-6_4_0-150700_53_11-default 5-150700.2.1 or later on kernel 6.4.0-150700.53.11 (SUSE-SU-2026:0202-1) or kernel-livepatch-6_4_0-150600_23_60-default 9-150600.2.1 or later on kernel 6.4.0-150600.23.60 (SUSE-SU-2026:0283-1).",
+        "Debian 12 bookworm hosts with the linux package below 6.1.153-1 (DSA-6009-1), Debian 13 trixie hosts with the linux package below 6.12.48-1 (DSA-6008-1), and Debian 11 bullseye hosts running the linux-6.1 kernel below 6.1.153-1~deb11u1 (DLA 4328-1), compared by installed package version and followed by a check that the host has rebooted into the fixed kernel. Debian records Debian 11's default linux package as not affected.",
+        "Siemens SIMATIC CN 4100 firmware below V5.0 (SSA-032379).",
+        "Google Container-Optimized OS milestone 121 instances on a build older than cos-121-18867-199-52, that is, cos-121-18867-0-94 (kernel COS-6.6.74) through cos-121-18867-199-43 (kernel COS-6.6.97), which includes the kernelCTF target cos-121-18867-90-97 (COS-6.6.93). The m121 release notes first list the fix, as KCTF-62708b9 (the abbreviated hash of upstream fix commit 62708b9452f8), for cos-121-18867-199-52, which still runs COS-6.6.97, so comparing the COS kernel version with the upstream 6.6.103 boundary wrongly flags cos-121-18867-199-52 and cos-121-18867-199-56 as affected. Milestones 109, 113 and 117 list the same fix in cos-109-17800-570-40 (COS-6.1.143), cos-113-18244-448-36 (COS-6.1.144) and cos-117-18613-339-52 (COS-6.6.97), which also run kernels below the upstream 6.1.149 and 6.6.103 boundaries, so instances on older m109, m113 or m117 builds are affected and are checked by image build in the same way.",
+        "The tls module listed by lsmod or in /proc/modules on a host where no application needs kernel TLS, a kernel built with CONFIG_TLS=y, where the tls code is part of the kernel image and there is no module to block, or the absence of a modprobe rule that stops the module from loading on hosts where Red Hat's mitigation was meant to be applied. While the tls code is loaded or built in, any local process can attach the tls upper-layer protocol to its own socket; only automatic loading of the module requires CAP_NET_ADMIN.",
+        "An increase in the TlsRxSw or TlsRxDevice counter in /proc/net/tls_stat, in any network namespace, on a host expected to have no kernel TLS receive sessions. These counters count the receive sessions opened in that namespace and are not decreased when the sessions close. TlsCurrRxSw and TlsCurrRxDevice count only the receive sessions installed when the file is read and fall when the sockets close, so they give a point-in-time view. The kernel keeps these counters per network namespace and frees a namespace's counters when the namespace is deleted, so sessions opened in a namespace that no longer exists are not counted. A rise in TlsDecryptError (record decryption failures) on a kernel TLS connection with no matching fault at the peer is a weaker signal.",
+        "A kernel.core_pattern value (sysctl kernel.core_pattern, /proc/sys/kernel/core_pattern) that the host's crash handler and configuration management did not set, especially a pipe to a program under /proc or to an executable outside the distribution's crash-handler path, and a root process started by the kernel's core-dump helper from an unexpected executable after another process crashed. The public kernelCTF exploit sources reference the kernel's core_pattern setting, /proc/self/exe and SIGSEGV. A change made through kernel memory does not pass through a write to /proc/sys/kernel/core_pattern, so compare the current value against the expected one rather than relying only on a file-write watch."
+      ],
+      "_ioc_source_note": "The socket calls that turn on kernel TLS (setsockopt with TCP_ULP set to tls, then TLS_RX), the statement that recv calls on such a socket are decrypted by the kernel, the /proc/net/tls_stat counters (TlsRxSw, TlsRxDevice, TlsCurrRxSw, TlsCurrRxDevice, TlsDecryptError) and the alert and handshake record types come from the kernel's TLS documentation at https://docs.kernel.org/networking/tls.html. That the kernel decreases only the TlsCurr counters when a socket closes and frees a namespace's counters when the namespace is deleted comes from net/tls/tls_main.c at https://raw.githubusercontent.com/gregkh/linux/master/net/tls/tls_main.c. The rule that only automatic loading of an upper-layer protocol module requires CAP_NET_ADMIN comes from net/ipv4/tcp_ulp.c at https://raw.githubusercontent.com/gregkh/linux/master/net/ipv4/tcp_ulp.c. The statements that an anonymous client of a kTLS server, or a malicious server that a kTLS client connects to, can trigger the flaw, the named kTLS consumers (OpenSSL with kTLS, NFS-over-TLS, SMB/RPC over TLS through net/handshake), the data, zero-length non-data, data record sequence, and the use-after-free and double-free effects (the functions process_rx_list, skb_copy_datagram_msg, tls_strp_load_anchor_with_queue and skb_fill_page_desc, the double free at socket teardown, and the oops, panic and list-corruption symptoms) come from the Linux kernel CNA's record at https://cveawg.mitre.org/api/cve/CVE-2025-39682. The cleartext TLS 1.2 record header and the rule against zero-length alert, handshake and ChangeCipherSpec records come from RFC 5246 at https://www.rfc-editor.org/rfc/rfc5246.txt, and the TLS 1.3 outer record type from RFC 8446 at https://www.rfc-editor.org/rfc/rfc8446.txt. The remote-trigger condition, the tls module mitigation and the fixed RHEL builds come from Red Hat's security data at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-39682.json. The fixed SUSE kernel-default, kernel-rt, kernel-azure and kernel-coco builds for SUSE Linux Enterprise Server 15 SP6, 15 SP7 and 16.0, SUSE Linux Enterprise Server for SAP Applications 15 SP6 and SP7, SUSE Linux Enterprise Server for SAP applications 16.0, SUSE Linux Enterprise Desktop 15 SP6 and SP7, SUSE Linux Enterprise Real Time 15 SP6 and SP7, the SUSE Linux Enterprise Module for Public Cloud, the SUSE Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6, SUSE Linux Micro 6.0, 6.1 and 6.2 and openSUSE Leap 15.6 and 16.0, the Affected state of the kernel-source-azure package on the 16.0 releases, and the fixed SUSE Linux Enterprise Server 16.1 GA kernels come from https://www.suse.com/security/cve/CVE-2025-39682.html, and the SUSE live patch packages and the kernels they are built for come from https://www.suse.com/support/update/announcement/2026/suse-su-20260202-1/ and https://www.suse.com/support/update/announcement/2026/suse-su-20260283-1/. The upstream version ranges and the Siemens SIMATIC CN 4100 range come from the NVD record at https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-39682. The Debian 12 and Debian 13 fixed versions, the Debian 11 linux-6.1 fixed version and the unaffected Debian 11 default kernel come from https://security-tracker.debian.org/tracker/CVE-2025-39682, and the Debian ABI-name format that makes uname -r misleading from the Debian Linux Kernel Handbook at https://kernel-team.pages.debian.net/kernel-handbook/ch-versions.html. The CN 4100 fixed firmware comes from https://cert-portal.siemens.com/productcert/html/ssa-032379.html. The kernelCTF targets, the empty capability and attack-surface requirements and the CONFIG_TLS requirement come from the exploit directory's metadata file at https://raw.githubusercontent.com/google/security-research/master/pocs/linux/kernelctf/CVE-2025-39682_lts_cos_mitigation/metadata.json. The exploit sources for the three kernelCTF targets, the exploit.c files under https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39682_lts_cos_mitigation/exploit, were searched for kernel interfaces and file paths rather than read in full. Each contains the AF_INET, SOCK_STREAM and INADDR_LOOPBACK constants, listen(), connect() and accept(), setsockopt() with TCP_ULP set to tls and with SOL_TLS and TLS_RX, a TLS 1.2 crypto-info structure, recvmsg(), splice() and pipe() calls, sched_setaffinity(), and references to the kernel's core_pattern setting, /proc/self/exe and SIGSEGV; none contains io_uring, unshare() or a user or network namespace flag. The exploitation write-up in that directory was not read. The Container-Optimized OS builds, their kernel versions and the builds whose notes list the fix as KCTF-62708b9 come from the milestone 109, 113, 117 and 121 release notes at https://cloud.google.com/container-optimized-os/docs/release-notes/m109, https://cloud.google.com/container-optimized-os/docs/release-notes/m113, https://cloud.google.com/container-optimized-os/docs/release-notes/m117 and https://cloud.google.com/container-optimized-os/docs/release-notes/m121; those notes do not name CVE-2025-39682, so the fixed build is identified by the fix commit's abbreviated hash. The following are general hunting heuristics rather than artifacts read from a source: treating an unfamiliar process that enables kernel TLS as suspicious, treating kernel warnings, oopses, panics, KASAN reports and slab or list-corruption reports with call traces in net/tls as possible exploitation attempts (the CNA's record gives the effects and function names, not a crash signature), privilege changes after kernel TLS setup, treating inbound connections from untrusted clients to a kernel TLS server and outbound kernel TLS connections to untrusted servers as exposure, reading a TLS 1.2 non-data record of the smallest ciphertext size the cipher suite produces as an empty record, treating a loaded or built-in tls module on a host where no application needs kernel TLS as exposure, and a rise in TlsDecryptError. The loopback reading of the exploit's connection, the advice to compare core_pattern against its expected value and the note on changes made through kernel memory are also hunting heuristics, built on the interfaces the exploit sources contain. Web searches for a Sigma, nuclei, Elastic or Splunk rule naming this CVE returned none. No actor infrastructure, file hash or C2 address is listed, because no source consulted attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "The upstream fix, commit 62708b9452f8, credits Muhammad Alifa Ramdhan and Billy Jheng Bing-Jhong, both with addresses at the Singapore security firm STAR Labs, as reporters. No source consulted says how they found the flaw or that AI tooling was involved.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2025-39682 (CWE-754, CVSS 9.8) plus the CISA KEV entry (added 2026-09-18), the Linux kernel CNA record, the Red Hat CVE record, SUSE's CVE page and live patch advisories SUSE-SU-2026:0202-1 and SUSE-SU-2026:0283-1, Debian advisories DSA-6008-1, DSA-6009-1 and DLA 4328-1, Google's Container-Optimized OS milestone 121 release notes, Siemens advisory SSA-032379 for the SIMATIC CN 4100, and upstream fix commit 62708b9452f8, which credits Muhammad Alifa Ramdhan and Billy Jheng Bing-Jhong of STAR Labs as reporters.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2025-39682 to the KEV catalog on 2026-09-18 with a due date of 2026-09-21 and records known ransomware campaign use as Unknown. The KEV entry also marks forensic triage as required under BOD 26-04, and its required action directs agencies to CISA's Forensics Triage Requirements, which call for an adequate forensic triage analysis to assess whether systems or network infrastructure have been impacted or compromised. The CISA Coordinator SSVC entry in the NVD record, dated 2026-09-18, marks exploitation as active, automatable as yes and technical impact as total. No source consulted names an actor, campaign, targeted sector or incident report for this CVE. Working exploit code for three kernelCTF targets has been public since 2025-09-22, when pull request #251 adding it to Google's google/security-research repository on GitHub was opened; the pull request was merged into the master branch on 2026-02-25.",
+    "attack_refs": [
+      "T1210",
+      "T1068",
+      "T1499.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, with security-relevant updates installed within organization-defined periods of their release. When Debian released fixes on 2025-09-22 and Red Hat released the main RHEL 9 and RHEL 10 fixes on 2025-09-29, NVD had not scored the flaw, and Red Hat rated it Moderate at CVSS 7.0 with high attack complexity. NVD still had no score when Red Hat released the RHEL 9.4 Extended Update Support fix on 2025-10-27 and the RHEL 9.2 Update Services for SAP Solutions fixes on 2025-10-29. NVD's first analysis, on 2026-01-27, scored it 7.1 as a local flaw (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). The Linux kernel CNA added a network 9.8 vector on 2026-07-30, and NVD replaced its 7.1 with 9.8 on 2026-09-21, three days after CISA listed the CVE in KEV on 2026-09-18. In these sources, the only sign of urgency while the fixes shipped was the exploit code for three kernelCTF targets, public in a GitHub pull request since 2025-09-22. SI-2 leaves the period to the organization and does not tie it to exploit publication, so a schedule keyed to Red Hat's rating or to NVD's score set no critical deadline while the fixes shipped. Evidence that reads installed kernel packages also reports the fix before it is running, because a new kernel package takes effect only after the host reboots into it; SUSE's kernel-livepatch packages for this CVE are the documented exception, and they apply only to the running kernel builds they are made for.",
+      "NIST-800-53-CM-7": "CM-7 requires a system to provide only essential capabilities and to prohibit or restrict functions, protocols and services that are not needed. The code at fault is the kernel TLS module, which applications turn on per socket with the TCP_ULP option rather than by starting a listening service, and Red Hat's mitigation is to prevent that module from loading. A least-functionality baseline written as permitted packages, ports and daemons does not list loadable kernel protocol modules, so hosts where no application uses kernel TLS keep the module loadable and nothing in the baseline shows whether it is loaded.",
+      "NIST-800-53-SC-8": "SC-8 requires the confidentiality and integrity of transmitted information to be protected, which organizations usually meet with TLS. With kernel TLS, the application sets the receive key with the TLS_RX socket option and the kernel then decrypts the records for every recv call on that socket, on connections the host accepted and on connections it opened. This CVE is in that receive path, and the exposure is not limited to TLS 1.3: NVD's description names TLS 1.3, where the record type is known only after decryption, as a case that queues records on the rx_list, while the Linux kernel CNA's record describes the trigger on a TLS 1.2 session and states that TLS 1.2 is zero-copy capable by default, so no unusual kernel configuration or socket option is needed. SC-8 evidence records protocol versions and cipher suites but not whether decryption runs in the kernel, so a system that meets SC-8 with TLS 1.2 or TLS 1.3 over kernel TLS relies on the vulnerable code without that appearing in the evidence.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) requires essential and important entities to take measures for security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure, and it sets no timeframe for applying a fix. For this CVE the fixes were announced for downstream products on very different dates: Debian 12 and Debian 13 on 2025-09-22 (DSA-6009-1 and DSA-6008-1), Red Hat's main RHEL 9 and RHEL 10 streams on 2025-09-29, Debian LTS for Debian 11's linux-6.1 kernel on 2025-10-13 (DLA 4328-1), and, for the SIMATIC CN 4100 process-control communication node, Siemens advisory SSA-032379 on 2026-05-12, which names firmware V5.0 as the fix. The Siemens advisory appeared eight months after NVD published the CVE on 2025-09-05 and more than seven months after exploit code for the kernel flaw became public on 2025-09-22, and it does not give the date V5.0 was released. An entity running the CN 4100 depends on the manufacturer to ship and announce fixed firmware, and the measure does not say how the entity handles a kernel flaw inside an embedded product before the manufacturer names a fix.",
+      "UK-CAF-B4": "CAF principle B4 (system security) expects systems that support essential functions to be securely configured and their known vulnerabilities managed. Exposure to this CVE depends on the kernel build and on how applications use kernel TLS. A remote peer can reach the flaw on any connection where the host has enabled kernel TLS receive, whether the host accepted the connection as a server or opened it as a client: Red Hat states the flaw can be triggered remotely only when kernel TLS is in use, and the Linux kernel CNA's record names OpenSSL with kTLS, NFS-over-TLS and SMB/RPC over TLS through net/handshake as reachable consumers, including a kTLS client that connects to a malicious server. A local user needs no capabilities, as the public exploits' metadata records, and can attach the tls upper-layer protocol to a socket of their own wherever the tls code is built into the kernel or the tls module is already loaded; only automatic loading of the module requires CAP_NET_ADMIN. A B4 review of installed packages, listening ports and kernel version shows none of these conditions, and a port review misses hosts that use kernel TLS only for outbound connections, while the kernel configuration (CONFIG_TLS), the lsmod output and the TlsRxSw and TlsRxDevice counters in /proc/net/tls_stat for each network namespace do show them. Those two counters count kernel TLS receive sessions opened and do not fall when the sockets close, unlike TlsCurrRxSw and TlsCurrRxDevice, and a namespace's counters are lost when the namespace is deleted. For the SIMATIC CN 4100, Siemens' remediation is an update to firmware V5.0 or later.",
+      "AU-Essential-8-Patch": "The Essential Eight treats the Linux kernel as an operating system. For internet-facing servers it requires the fix within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1877), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694), at every maturity level. For workstations and non-internet-facing servers it allows one month at Maturity Levels One and Two (ISM-1695); at Maturity Level Three it requires 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696) and one month otherwise (ISM-1902). Red Hat rated the flaw Moderate, but exploit code for three kernelCTF targets had been public in a GitHub pull request since 2025-09-22, a week before Red Hat released the main RHEL 9 and RHEL 10 fixes on 2025-09-29. A working exploit therefore existed at release, and the 48-hour window for internet-facing servers ended on 2025-10-01 on the main streams, on 2025-10-29 on RHEL 9.4 Extended Update Support (fixed 2025-10-27) and on 2025-10-31 on RHEL 9.2 Update Services for SAP Solutions (fixed 2025-10-29). On those RHEL streams, meeting the window would have fixed hosts more than ten months before CISA listed the CVE in KEV on 2026-09-18. The shortfall this CVE exposes is the time before a fix existed. Every window runs from the vendor's release, and while the exploit was public, Red Hat had no fix until 2025-09-29, SUSE listed the Liberty Linux 9 fix (RHSA-2025:16880) on 2025-09-30, and SUSE published its first SUSE Linux Enterprise update, SUSE-SU-2025:03600-1, on 2025-10-15. Red Hat's record gives no date for its one mitigation, blocking the tls module, and a host whose applications need kernel TLS cannot use it. The Essential Eight also does not require a compromise assessment of a host that ran an exploitable kernel before it was patched.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires information about technical vulnerabilities to be obtained, the organization's exposure evaluated and appropriate measures taken. Evaluating exposure to this CVE from NVD's upstream ranges alone gives the wrong answer on Red Hat systems: NVD lists kernels from 6.0 onward, yet Red Hat fixed the flaw in RHEL 9's 5.14.0-based kernels (kernel-0:5.14.0-570.49.1.el9_6 in RHSA-2025:16880, with separate 9.2 and 9.4 update-stream builds) and records RHEL 6, 7 and 8 as not affected. A register that compares the running kernel version with 6.0 marks every RHEL 9 host as out of scope. On Container-Optimized OS the same comparison errs the other way, since builds cos-121-18867-199-52 and cos-121-18867-199-56 run COS-6.6.97, below the upstream 6.6.103 boundary, yet their release notes list the fix. No version comparison shows whether the host uses kernel TLS on any connection, inbound or outbound, which is what makes it remotely exposed."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": true,
+    "live_patch_tools": [
+      "SUSE Linux Enterprise Live Patching (kernel-livepatch packages)"
+    ],
+    "live_patch_notes": "SUSE ships live patches for this fix. SUSE-SU-2026:0202-1 (released 2026-01-21) and SUSE-SU-2026:0283-1 (released 2026-01-23) list CVE-2025-39682 and install through the SUSE Linux Enterprise Live Patching 15-SP6 and 15-SP7 modules as kernel-livepatch packages, each built for one running kernel (for example kernel-livepatch-6_4_0-150700_53_11-default for kernel 6.4.0-150700.53.11), and both advisories list their SP6 live patch packages for openSUSE Leap 15.6 as well. SUSE's CVE page lists further kernel-livepatch packages for SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.0, 6.1 and 6.2. A SUSE host whose running kernel has no listed live patch, and any host that takes the fix as a kernel package, runs the fixed code only after rebooting into the new kernel. The Red Hat, Debian and Siemens sources consulted document no live patch, and the Container-Optimized OS fix ships as a new m121 image build. The step that applies without a new kernel is Red Hat's mitigation of preventing the tls module from loading, which suits hosts that do not use kernel TLS; a modprobe rule stops future loads and does not unload a tls module that is already loaded, and a kernel built with CONFIG_TLS=y has no tls module to block. The SIMATIC CN 4100 fix is a firmware update to V5.0. NVD's ranges include kernel lines with no fixed build of their own (6.0, 6.2 to 6.5, 6.7 to 6.11 and 6.13 to 6.15), and CISA notes that the affected products could be end of life and advises moving to a supported version.",
+    "affected": "The Linux kernel's TLS (kTLS) receive path. A remote peer reaches it on any TCP connection where the host has enabled kernel TLS receive, whether the host accepted the connection as a server or opened it as a client, and Red Hat states the flaw can then be triggered remotely. A local user with no capabilities reaches it by enabling kernel TLS on a socket of their own wherever the tls code is built into the kernel or the tls module is loaded, and the public exploits are local privilege escalations written for Google's kernelCTF targets lts-6.12.40, mitigation-v4-6.6 and Container-Optimized OS build cos-121-18867.90.97. The Linux kernel CNA's record describes the result as a use-after-free and double free of the TLS strparser's anchor buffer and of TCP receive-queue buffers, which copies freed kernel memory into the receiving process's buffer, lets incoming data be written into freed memory and corrupts slab state. NVD scores the impact as high for confidentiality, integrity and availability, and CISA's SSVC entry records technical impact as total. Downstream builds that carry the flaw include Red Hat Enterprise Linux 9 and 10 kernels; the SUSE Liberty Linux 9 kernel, which SUSE fixes at the same build and advisory as RHEL 9; SUSE Linux Enterprise Server 15 SP6 and SP7, SUSE Linux Enterprise Server for SAP Applications 15 SP6 and SP7 and SUSE Linux Enterprise Desktop 15 SP6 and SP7 kernels, including the 15 SP6 and SP7 kernel-azure builds; the kernel-coco build in the SUSE Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6; SUSE Linux Enterprise Real Time 15 SP6 and SP7 kernel-rt builds; SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.0, 6.1 and 6.2 kernels; openSUSE Leap 15.6 kernels; the Debian 12 and Debian 13 linux packages; Debian 11's linux-6.1 kernel; Google Container-Optimized OS builds older than the first fixed build of their milestone (cos-109-17800-570-40 on milestone 109, cos-113-18244-448-36 on milestone 113, cos-117-18613-339-52 on milestone 117 and cos-121-18867-199-52 on milestone 121); and Siemens SIMATIC CN 4100 firmware before V5.0. Red Hat records RHEL 6, 7 and 8 as not affected, and Debian records Debian 11's default linux package as not affected.",
+    "affected_versions": [
+      "Linux kernel 6.0 up to but not including 6.1.149 (6.1.149 is fixed); this range covers the whole 6.0 line, which has no fixed build of its own",
+      "Linux kernel 6.2 up to but not including 6.6.103 (6.6.103 is fixed); the 6.2 to 6.5 lines have no fixed build of their own",
+      "Linux kernel 6.7 up to but not including 6.12.44 (6.12.44 is fixed); the 6.7 to 6.11 lines have no fixed build of their own",
+      "Linux kernel 6.13 up to but not including 6.16.4 (6.16.4 is fixed); the 6.13 to 6.15 lines have no fixed build of their own",
+      "Linux kernel 6.17-rc1 and 6.17-rc2 (NVD lists no other 6.17 build as affected)",
+      "Red Hat Enterprise Linux 9 kernel (5.14.0 based): fixed in kernel-0:5.14.0-570.49.1.el9_6 (RHSA-2025:16880); RHEL 9.4 Extended Update Support fixed in kernel-0:5.14.0-427.96.1.el9_4 (RHSA-2025:19104); RHEL 9.2 Update Services for SAP Solutions fixed in kernel-0:5.14.0-284.144.1.el9_2 (RHSA-2025:19224) and kernel-rt-0:5.14.0-284.144.1.rt14.429.el9_2 (RHSA-2025:19223)",
+      "Red Hat Enterprise Linux 10 kernel: fixed in kernel-0:6.12.0-55.37.1.el10_0 (RHSA-2025:16904)",
+      "SUSE Liberty Linux 9 kernel before 5.14.0-570.49.1.el9_6, the build and advisory (RHSA-2025:16880) that fix RHEL 9",
+      "SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6 and SUSE Linux Enterprise Desktop 15 SP6: kernel-default before 6.4.0-150600.23.73.1 (6.4.0-150600.23.73.1 is fixed); on SUSE Linux Enterprise Server 15 SP6 and its SAP Applications edition, kernel-azure before 6.4.0-150600.8.52.1, the kernel-azure build SUSE also lists for the SUSE Linux Enterprise Module for Public Cloud 15 SP6",
+      "SUSE Linux Enterprise Server 15 SP7, SUSE Linux Enterprise Server for SAP Applications 15 SP7 and SUSE Linux Enterprise Desktop 15 SP7: kernel-default before 6.4.0-150700.53.19.1 (6.4.0-150700.53.19.1 is fixed); on SUSE Linux Enterprise Server 15 SP7 and its SAP Applications edition, kernel-azure before 6.4.0-150700.20.15.2, the kernel-azure build SUSE also lists for the SUSE Linux Enterprise Module for Public Cloud 15 SP7",
+      "SUSE Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6: kernel-coco before 6.4.0-15061.32.coco15sp6.1 (6.4.0-15061.32.coco15sp6.1 is fixed)",
+      "SUSE Linux Enterprise Real Time 15 SP6 kernel-rt before 6.4.0-150600.10.55.1 and SUSE Linux Enterprise Real Time 15 SP7 kernel-rt before 6.4.0-150700.7.19.1; SUSE numbers kernel-rt builds separately from kernel-default, so a Real Time host is compared with the kernel-rt build",
+      "SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.2: kernel-default before 6.12.0-160000.6.1 (6.12.0-160000.6.1 is fixed); on openSUSE Leap 16.0 and SUSE Linux Micro 6.2, kernel-rt is fixed at the same version. SUSE's status table marks kernel-source-azure on SUSE Linux Enterprise Server 16.0, its SAP applications edition and openSUSE Leap 16.0 as Affected and lists no fixed kernel-azure build for them. SUSE lists the SUSE Linux Enterprise Server 16.1 GA kernels, kernel-default and kernel-azure 6.12.0-160099.45.1, as fixed",
+      "SUSE Linux Micro 6.0 and 6.1 kernel-default before 6.4.0-35.1 and kernel-rt before 6.4.0-37.1",
+      "openSUSE Leap 15.6 kernel-default before 6.4.0-150600.23.73.1, kernel-rt before 6.4.0-150600.10.55.1 and kernel-azure before 6.4.0-150600.8.52.1",
+      "SUSE's kernel-livepatch packages for this CVE, including those from SUSE-SU-2026:0202-1 and SUSE-SU-2026:0283-1, close the flaw without a reboot on the specific running kernels they are built for",
+      "Debian 12 bookworm linux packages before 6.1.153-1 (6.1.153-1 is fixed, DSA-6009-1)",
+      "Debian 13 trixie linux packages before 6.12.48-1 (6.12.48-1 is fixed, DSA-6008-1)",
+      "Debian 11 bullseye linux-6.1 packages: fixed in 6.1.153-1~deb11u1 (DLA 4328-1); Debian 11's default linux package is not affected",
+      "Google Container-Optimized OS milestone 121 builds older than cos-121-18867-199-52: cos-121-18867-0-94 (kernel COS-6.6.74) through cos-121-18867-199-43 (kernel COS-6.6.97), including the kernelCTF target cos-121-18867-90-97 (COS-6.6.93). cos-121-18867-199-52, released September 02, 2025 on COS-6.6.97, is the first m121 build whose release notes list the fix, as KCTF-62708b9",
+      "Google Container-Optimized OS milestone 109 builds older than cos-109-17800-570-40, milestone 113 builds older than cos-113-18244-448-36 and milestone 117 builds older than cos-117-18613-339-52. All three fixed builds were released September 02, 2025 and list the fix as KCTF-62708b9, and they run kernels COS-6.1.143, COS-6.1.144 and COS-6.6.97, below the upstream 6.1.149 and 6.6.103 boundaries, so these milestones are checked by image build",
+      "Siemens SIMATIC CN 4100 firmware before V5.0 (V5.0 is fixed, SSA-032379)"
+    ],
+    "vendor_update_paths": [
+      "Upgrade to an upstream stable kernel at or above 6.1.149, 6.6.103, 6.12.44 or 6.16.4, or to a 6.17 build other than the 6.17-rc1 and 6.17-rc2 release candidates, and reboot into it. Hosts on the 6.0, 6.2 to 6.5, 6.7 to 6.11 or 6.13 to 6.15 lines have no fixed build on their own line and must move to a line that carries the fix.",
+      "Red Hat Enterprise Linux 10: install kernel-0:6.12.0-55.37.1.el10_0 (RHSA-2025:16904) and reboot into it.",
+      "Red Hat Enterprise Linux 9: install kernel-0:5.14.0-570.49.1.el9_6 (RHSA-2025:16880); on 9.4 Extended Update Support install kernel-0:5.14.0-427.96.1.el9_4 (RHSA-2025:19104); on 9.2 Update Services for SAP Solutions install kernel-0:5.14.0-284.144.1.el9_2 (RHSA-2025:19224) or kernel-rt-0:5.14.0-284.144.1.rt14.429.el9_2 (RHSA-2025:19223). SUSE Liberty Linux 9 takes the same fixed build, kernel 5.14.0-570.49.1.el9_6 from RHSA-2025:16880. Reboot into the new kernel.",
+      "SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise Desktop 15 SP6 and openSUSE Leap 15.6: install kernel-default 6.4.0-150600.23.73.1 or later, or kernel-azure 6.4.0-150600.8.52.1 or later on hosts running the kernel-azure flavor, and reboot into it. SUSE Linux Enterprise Server 15 SP7, SUSE Linux Enterprise Server for SAP Applications 15 SP7 and SUSE Linux Enterprise Desktop 15 SP7: install kernel-default 6.4.0-150700.53.19.1 or later, or kernel-azure 6.4.0-150700.20.15.2 or later on kernel-azure hosts, and reboot into it.",
+      "SUSE Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6: install kernel-coco 6.4.0-15061.32.coco15sp6.1 or later and reboot into it.",
+      "SUSE Linux Enterprise Real Time 15 SP6 and openSUSE Leap 15.6 hosts running kernel-rt: install kernel-rt 6.4.0-150600.10.55.1 or later. SUSE Linux Enterprise Real Time 15 SP7: install kernel-rt 6.4.0-150700.7.19.1 or later. Reboot into the new kernel.",
+      "SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0, openSUSE Leap 16.0 and SUSE Linux Micro 6.2: update kernel-default to 6.12.0-160000.6.1 or later (on openSUSE Leap 16.0 and SUSE Linux Micro 6.2, kernel-rt to 6.12.0-160000.6.1 or later on real-time hosts). SUSE lists no fixed kernel-azure build for SUSE Linux Enterprise Server 16.0, its SAP applications edition or openSUSE Leap 16.0, and it lists kernel-azure 6.12.0-160099.45.1 in the SUSE Linux Enterprise Server 16.1 GA packages as fixed. SUSE Linux Micro 6.0 and 6.1: update kernel-default to 6.4.0-35.1 or later, or kernel-rt to 6.4.0-37.1 or later on real-time hosts. Reboot into the new kernel.",
+      "SUSE live patches: where SUSE lists a live patch for the running kernel, installing that kernel-livepatch package through the SUSE Linux Enterprise Live Patching module applies the fix without a reboot. SUSE-SU-2026:0202-1 carries kernel-livepatch-6_4_0-150700_53_11-default for SP7 kernel 6.4.0-150700.53.11 (zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP7-2026-205=1) and kernel-livepatch-6_4_0-150600_23_65-default for SP6 kernel 6.4.0-150600.23.65 (zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2026-202=1). SUSE-SU-2026:0283-1 carries kernel-livepatch-6_4_0-150700_51-default for SP7 kernel 6.4.0-150700.51 (zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP7-2026-282=1) and kernel-livepatch-6_4_0-150600_23_60-default for SP6 kernel 6.4.0-150600.23.60 (zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2026-283=1).",
+      "Debian 12 bookworm: upgrade the linux packages to 6.1.153-1 or later (DSA-6009-1) and reboot into the new kernel.",
+      "Debian 13 trixie: upgrade the linux packages to 6.12.48-1 or later (DSA-6008-1) and reboot into the new kernel.",
+      "Debian 11 bullseye: upgrade the linux-6.1 packages to 6.1.153-1~deb11u1 or later (DLA 4328-1) and reboot into the new kernel.",
+      "Google Container-Optimized OS: move instances to the first fixed build of their milestone or later (cos-109-17800-570-40 on milestone 109, cos-113-18244-448-36 on milestone 113, cos-117-18613-339-52 on milestone 117, cos-121-18867-199-52 on milestone 121), each of which lists the fix as KCTF-62708b9 in its release notes, and boot them on the new image. For another milestone, find KCTF-62708b9 in that milestone's release notes.",
+      "Siemens SIMATIC CN 4100: update the firmware to V5.0 or later, per SSA-032379.",
+      "Until the fixed kernel is running, Red Hat's mitigation is to prevent the tls module from loading. This removes the remote and local attack paths only on hosts where no application needs kernel TLS and tls is built as a module, and a modprobe rule does not unload a tls module that is already loaded."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 22,
+      "patch_available": -15,
+      "live_patch_available": -10,
+      "reboot_required": 5
+    },
+    "rwep_score": 67,
+    "rwep_notes": "RWEP 67. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +22, patch_available -15, live_patch_available -10, reboot_required +5. Σ factors === rwep_score."
+  },
   "CVE-2026-19490": {
     "name": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability",
     "cvss_score": 9.3,
@@ -2003,7 +2595,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The vendor release note lists the reporter as Anonymous and states exploits existed in the wild, indicating discovery through in-the-wild detection of a zero-day. No AI involvement is claimed, and the disclosure predates AI-assisted vulnerability discovery becoming operational.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2020-16017 (CWE-416, CVSS 9.6) + CISA KEV (added 2021-11-03) + Google Chrome stable channel release 86.0.4240.198, reported anonymously and confirmed exploited in the wild, with the Microsoft Edge 86.0.622.69 security release note.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03. Google's stable channel release states it is aware of reports that exploits for this flaw and for CVE-2020-16013 exist in the wild; the bug was reported anonymously on 2020-11-07 and fixed four days later. Microsoft's Edge 86.0.622.69 release on 2020-11-13 also fixed both flaws and describes them as reported by the Chromium team as having an exploit in the wild. No named campaign is attributed to it in the sources read.",
@@ -2460,7 +3052,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported anonymously to Google on 2021-09-08; no reporter identity or discovery method is public. No source claims any AI involvement in discovery or weaponization.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2021-30633 (CWE-416, CVSS 9.6) + CISA KEV (added 2021-11-03) + Google Chrome desktop update advisory (Chrome 93.0.4577.82, 2021-09-13). The flaw was reported anonymously.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this on 2021-11-03 with a 2021-11-17 due date and records the ransomware field as Unknown. Google's September 13, 2021 Chrome release states it is aware that exploits for CVE-2021-30632 and CVE-2021-30633 exist in the wild, and Microsoft's Edge 93.0.961.52 release note states the Chromium team reported an exploit in the wild for CVE-2021-30633. GitHub Security Lab assesses that CVE-2021-30633 can be used to escape the sandbox once the renderer flaw CVE-2021-30632 has compromised the renderer, together giving a full remote compromise of Chrome; its author states he had no non-public information about the bugs and that his analysis may differ from how they were exploited in the wild. Google's note does not say the two were used together. Both were reported anonymously, and no source names an actor or campaign.",
@@ -4531,7 +5123,7 @@
     },
     "ai_discovered": true,
     "ai_discovery_notes": "CERT Polska (part of the NASK National Research Institute) states the RouterOS vulnerabilities were discovered by Slawomir Rozbicki using the GPT-5.5-cyber and GPT-5.6-sol models within an agent-based research environment under the OpenAI GTAC program; the models automated the laboratory and systematically searched protocol state machines, and human researchers verified every hypothesis. An independent reverse-engineering effort separately described its RouterOS diff analysis and lab reproduction as AI driven.",
-    "ai_discovery_source": "academic_ai_fuzzing",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "discovery_attribution_note": "NVD records CVE-2026-86060 as CWE-88 at CVSS 9.2; CISA added it to the KEV catalog on 2026-09-10; MikroTik's 'September 2026 vulnerability' advisory is the vendor source. CERT Polska (NASK) credits Slawomir Rozbicki with the discovery, which he made with the GPT-5.5-cyber and GPT-5.6-sol models in an agent-based research environment under the OpenAI GTAC program, and Nick Pratley with the reverse-engineering analysis.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2026-86060 to KEV on 2026-09-10 with a 2026-09-13 due date and records ransomware use as Unknown. CERT Polska reports observing attacks against internet-exposed RouterOS since at least 2 September 2026, using the MikroTrick chain to take full control of devices whose SSH service is reachable, and attributes the confirmed activity, including creation of a highly privileged 'ops' account, to source address 82.192.72.4, with 103.102.31.18 seen in further attempts. No source names an actor or a campaign, although a reverse-engineering write-up lists three domains it describes as campaign infrastructure.",
@@ -7222,7 +7814,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported on 2020-10-19 by Sergei Glazunov of Google Project Zero, who had the in-the-wild exploit sample; Project Zero notes the bug is relatively straightforward to find by manual code review and may have been found through variant analysis of an earlier FreeType issue. No source claims any AI involvement in discovery or weaponization.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2020-15999 (CWE-787, CVSS 9.6) + CISA KEV (added 2021-11-03) + Google Chrome desktop update advisory (Chrome 86.0.4240.111, 2020-10-20), the FreeType 2.10.4 release note, Mozilla advisories MFSA 2020-50, 2020-51 and 2020-52 and NetApp advisory NTAP-20240812-0001, credited to Sergei Glazunov of Google Project Zero.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to the KEV catalog on 2021-11-03 (due 2021-11-17), ransomware use recorded as Unknown. Google's release note states awareness of an in-the-wild exploit, and FreeType shipped 2.10.4 as an emergency release telling all users to update immediately. Project Zero documented it as the renderer stage of the October 2020 watering-hole operation: one exploit server delivered it to Chrome on Windows with the cng.sys kernel flaw CVE-2020-17087, and the other delivered it on Android to Chrome, paired with the sandbox escape CVE-2020-16010, and to Samsung Browser, paired with a Chromium n-day. Both Android targets were fully patched Android 10 devices. Project Zero attributes the operation to the actor from its February 2020 campaign and names no ransomware operator.",
@@ -7450,7 +8042,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported anonymously to Google on 2021-04-07; no reporter identity or discovery method is public. No source claims any AI involvement in discovery or weaponization.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2021-21206 (CWE-416, CVSS 8.8) + CISA KEV (added 2021-11-03) + Google Chrome desktop update advisory (Chrome 89.0.4389.128, 2021-04-13). The flaw was reported anonymously.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records the ransomware field as Unknown. Google's April 13, 2021 Chrome release states it is aware of reports that exploits for CVE-2021-21206 and CVE-2021-21220 exist in the wild, and Microsoft's Edge 89.0.774.77 release note states the Chromium team reported an exploit in the wild. The root-cause analysis states the exploit corrupted PartitionPage metadata to gain arbitrary read and write, then wrote to a WebAssembly RWX page to run code. No source names a campaign or actor.",
@@ -8829,7 +9421,7 @@
     },
     "ai_discovered": true,
     "ai_discovery_notes": "Horizon3, a security firm, states its autonomous vulnerability-research system initially flagged the vulnerability, and that an agent had automatically de-obfuscated Sangoma's Perl handler before the SQL injection sink in the phone-notification code was identified. Horizon3 places the work in April 2026 and gives no date for the flagging itself. Security Risk Advisors reported the same flaw independently and credits Cameron Lischke.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "discovery_attribution_note": "Compiled from NVD CVE-2026-9586 (CWE-89, CVSS 9.3) + CISA KEV (added 2026-09-02) + Sangoma Switchvox 8.4.0.2 release notes. Surfaced by Horizon3's own autonomous vulnerability-research system; independently reported by Cameron Lischke of Security Risk Advisors.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2026-9586 to KEV on 2026-09-02 with a 2026-09-05 due date and records ransomware use as Unknown. Horizon3, running internet honeypots in coordination with Defused Cyber, recorded the first valid exploitation attempt on 30 August 2026, using 176.65.148.184 as the destination of a reverse shell and following it with a process-enumeration command; Shodan shows roughly four thousand appliances on the internet, most of them in the United States. No named actor is attributed.",
@@ -16004,7 +16596,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found as in-the-wild zero-days: the flaws were disclosed through incident-response investigation by Accellion and Mandiant/FireEye after active exploitation, not by pre-disclosure research. Predates AI-assisted discovery; no AI tooling is credited in any source consulted.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-27104 (CWE-78, CVSS 3.1 base 9.8), the Accellion vendor CVE text (accellion/CVEs archive), CISA KEV (added 2021-11-03, ransomware Known), CISA advisory AA21-055A, and the Mandiant threat-intelligence report 'Accellion FTA Exploited for Data Theft and Extortion' (UNC2546/UNC2582, DEWMODE). No public proof-of-concept exploit was found; the CVEDB PoC aggregator records 'No PoCs from references' for this CVE.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2021-27104 to KEV on 2021-11-03 with a compressed 2021-11-17 due date, and records ransomware use as Known. Mandiant (FireEye) attributes the exploitation to the cluster UNC2546, which from mid-December 2020 exploited the FTA zero-days and installed the DEWMODE web shell (at /home/seos/courier/about.html and /home/httpd/html/about.html); a separate cluster, UNC2582, conducted the follow-on data-theft extortion, threatening publication on the 'CL0P^_- LEAKS' .onion site from late January 2021, with victim counts rising through February 2021. CISA/FBI documented the campaign and DEWMODE in advisory AA21-055A. This is a documented, named campaign.",
@@ -18179,7 +18771,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The S2-061 advisory credits named human researchers and the GitHub Security Lab advisory GHSL-2020-205 is a manual code-review finding on the double-evaluation pattern. Nothing in the sources retrieved indicates AI involvement in discovery.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "The Apache S2-061 advisory credits Alvaro Munoz (pwntester at github dot com) and Masato Anzai of Aeye Security Lab, inc. The Metasploit module metadata additionally credits Alvaro Munoz for the CVE-2020-17530 discovery, ka1n4t for the CVE-2020-17530 proof of concept, Matthias Kaiser for the earlier CVE-2019-0230, and Spencer McIntyre for the module itself. Alvaro Munoz's advisory is published as GHSL-2020-205 (securitylab.github.com), referenced from the Metasploit module.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2020-17530 to KEV on 2021-11-03 with a due date of 2022-05-03 — the six-month tier applied to the pre-2021 entries in that first catalog. No named campaign, no named threat actor and no incident report is public in the sources retrieved, and the KEV ransomware field reads 'Unknown'; this entry carries no attribution. What is established beyond the KEV listing is the tooling state: a shipped Nuclei template, a Metasploit module and a public PoC repository mean exploitation requires no exploit development at all, and the EPSS score of 0.95931 (99.869th percentile, 2026-08-31) reflects continued opportunistic scanning rather than a specific intrusion set.",
@@ -19910,8 +20502,8 @@
       "_ioc_source_note": "No detection rule, detection template or vendor detection guidance for this CVE was reachable. The only source verified is Apple's advisory for iOS 14.4 and iPadOS 14.4 (HT212146, served at https://support.apple.com/en-us/103123), which states the impact, states that the fix is improved locking, and credits an anonymous researcher. It records nothing an operator can match on: no log string, no file path, no process name and no network artifact. Every indicator therefore comes from the advisory and from the mechanics of the defect rather than from an observed artifact. Read them as hunting heuristics, including the kernel-panic frequency signal, the assertion that a failed voucher race panics rather than failing quietly, the sandboxed process gaining capabilities beyond its entitlements, and the voucher frames in a panic backtrace. The build-level host indicators are the only ones that can be checked directly, and the Catalina and Mojave lines need the presence of Security Update 2021-001 rather than a version string. The public exploit source for this CVE is C code for a kernel race: the repository holds voucher_leak.c, iosurface.c, their headers and an entitlements file, and no written description of the technique, so it carries nothing an operator could match on and nothing here is drawn from it. Apple names no actor, and no source reviewed attributes this CVE to a named campaign, so no actor infrastructure, file hash or command-and-control address is listed."
     },
     "ai_discovered": false,
-    "ai_discovery_notes": "Apple credits an anonymous researcher and gives no further detail, so the discovery method is not established. Nothing reviewed indicates AI involvement, and none is asserted; the source is recorded as unknown rather than inferred from the era.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_notes": "Apple credits an anonymous researcher and gives no further detail, so the discovery method is not established. Nothing reviewed indicates AI involvement, and none is asserted.",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Apple's HT212146 credits 'An anonymous researcher' for CVE-2021-1782. The anonymity is itself notable on an issue Apple flags as possibly actively exploited, but nothing in the sources reviewed identifies the reporter or the party that observed the exploitation. Synacktiv's later public exploit is analysis of the patched bug, not the discovery.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's iOS 14.4 and iPadOS 14.4 advisory (HT212146, released 2021-01-26) states for this issue that Apple is aware of a report that it may have been actively exploited, and credits an anonymous researcher. CISA KEV-listed it 2021-11-03 with a 2021-11-17 deadline and records ransomware use as 'Unknown'. Two WebKit flaws fixed in the same release, CVE-2021-1870 and CVE-2021-1871, carry the same actively-exploited wording - a remote code execution primitive and a kernel escalation shipped in one update, which is the shape of a complete chain, and neither of those CVE ids appears in this chunk. Apple attributes the activity to no named actor, and no public campaign name for this chain was located in the sources reviewed; the attribution that exists is Apple's own hedged reporting language and nothing further should be read into it.",
@@ -20034,7 +20626,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Apple credits an anonymous researcher, which establishes only that the reporter chose not to be named. Nothing in the sources retrieved indicates AI involvement in discovery.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Apple credits an anonymous researcher for CVE-2021-1870 and for its sibling CVE-2021-1871 in HT212146 (iOS 14.4 and iPadOS 14.4); both entries were updated 2021-05-28. No further attribution exists in the sources retrieved. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-284 is used for the logic failure Apple addressed 'with improved restrictions', which lets processed web content reach behaviour it should not.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's HT212146 and HT212147 state, for this CVE and for CVE-2021-1871: 'Apple is aware of a report that this issue may have been actively exploited.' Both entries were credited to an anonymous researcher and both were updated on 2021-05-28. That vendor sentence is the whole of what is established — Apple names no actor, no campaign and no targeting, and 'a report that this issue may have been actively exploited' is deliberately weaker than a confirmation of a campaign. CISA added the CVE on 2021-11-03 with a fourteen-day due date of 2021-11-17. No incident report naming this CVE is public in the sources retrieved and the KEV ransomware field reads 'Unknown'; this entry carries no attribution.",
@@ -24079,7 +24671,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Citrix disclosed the flaw in advisory CTX696604 on 2026-06-30. No AI tooling is credited in any source consulted, and no external finder is named in the material that was reachable - the Citrix support article itself did not render for retrieval, so the acknowledgement section could not be read.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-8452 (CWE-119, CVSS 4.0 base 8.8), CISA KEV (added 2026-08-26, due 2026-08-29), watchTowr Labs' 2026-08-14 root-cause and exploitation write-up, Bishop Fox's patch-verification analysis, and Help Net Security's 2026-08-27 report of Defused and Previdian exploitation telemetry. The finder credited by Citrix in CTX696604 could not be read and is therefore not asserted.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2026-8452 to KEV on 2026-08-26 with a due date of 2026-08-29 - three days - and recorded ransomware use as Unknown. The exploitation reporting that matches the listing window is: threat-intelligence firm Defused recorded the first exploitation hits on 2026-08-14, the same day watchTowr published; Previdian reported 'This morning we started seeing exploitation for CVE-2026-8452' from three unique IPs in three different countries; and the Canadian Centre for Cyber Security confirmed in-the-wild exploitation on 2026-08-17. Observed post-exploitation is opportunistic rather than targeted - PHP web shells named x.php and z.php dropped on the appliance and discovery commands id and echo run to fingerprint what responded. No actor codename, no campaign name and no ransomware family is attached to this CVE by any source consulted, and the pattern reported is untargeted internet-wide scanning, so no attribution should be inferred.",
@@ -25682,7 +26274,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered in the wild in April 2013 and reported to Microsoft by Daniel Caselden of FireEye, with iSIGHT Partners also credited in the MS13-038 acknowledgements. This predates AI-assisted vulnerability discovery entirely and no AI tooling is credited anywhere.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-1347 (CWE-416, CVSS 3.1 base 8.8), Microsoft Security Bulletin MS13-038 (published 2013-05-14, KB2847204, revision 1.1 on 2013-05-29) and Microsoft Security Advisory 2847140, CISA KEV (added 2022-03-03), Cisco's 2013-05-04 analysis of the Department of Labor watering hole, and the Rapid7 module documentation. MS13-038 credits Daniel Caselden of FireEye and iSIGHT Partners.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-03-03 with a 2022-03-24 due date and recorded ransomware use as Unknown; the exploitation itself is from 2013 and is documented in the vendor bulletin, which states that Microsoft is aware of attacks attempting to exploit this vulnerability through Internet Explorer 8 and that the issue was publicly disclosed before the patch. The named campaign is the watering-hole compromise of the United States Department of Labor website in late April 2013: pages hosting nuclear-related content were injected to load malicious content from dol.ns01.us (a changeip.org dynamic-DNS name, first sighted 2013-04-30, resolving to 96.44.136.115), with command and control at microsoftUpdate.ns1.name, also on changeip.org. Cisco's analysis records that the injected code performed reconnaissance on visitors, collecting antivirus and browser plug-in information before delivering the exploit. Attribution is explicitly unsettled in the source: CrowdStrike is quoted as not having concluded that the command and control is related to DeepPanda, so no actor should be named. Microsoft credits Daniel Caselden of FireEye and iSIGHT Partners for reporting the vulnerability.",
@@ -25918,7 +26510,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found as an in-the-wild zero-day in February 2013, years before AI-assisted vulnerability discovery was operationally available. FireEye announced the discovery on 2013-02-12; Adobe's APSA13-02 responded to active attacks rather than to a coordinated report. No AI tooling appears in any source consulted.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-0640 (CWE-787, exploited in the wild February 2013), Adobe advisory APSA13-02, CERT/CC vulnerability note VU#422807, Kaspersky's MiniDuke analysis on Securelist, and CISA KEV (added 2022-03-03). CERT/CC's note names no reporting researcher; the public discovery announcement is FireEye's of 2013-02-12.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "NVD records the flaw 'as exploited in the wild in February 2013'; Adobe published APSA13-02 as an out-of-cycle advisory in response. FireEye announced the discovery on 2013-02-12. Kaspersky's analysis ties the PDF zero-day to the campaign it first called ItaDuke - named for Duqu similarities and Italian comments in the shellcode - and then MiniDuke, counting 59 unique victims across 23 countries including Belgium, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Portugal, Romania, Russia, Spain, Turkey, Ukraine, the United Kingdom and the United States, with the operators still active through at least 2013-02-20. The payload was a roughly 20 KB downloader carrying an assembler-written backdoor whose C2 sat in Panama and Turkey and which used Twitter and Google Search as fallback channels by resolving encrypted strings from tweets and search results. Kaspersky attributes no state sponsor; no ransomware family is named by any source consulted, and CISA records ransomware use as Unknown. CISA added the CVE to KEV on 2022-03-03 with a 2022-03-24 due date - nine years after the exploitation it records.",
@@ -27380,7 +27972,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Adobe in security bulletin APSB10-07 in February 2010. The bulletin's acknowledgement section could not be retrieved, so no finder is named here; no AI tooling is credited in any source consulted, and the date predates AI-assisted vulnerability discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2010-0188 (no CWE assigned, CVSS 3.1 base 7.8), CISA KEV (added 2022-03-03, ransomware Known), Adobe bulletin APSB10-07, Red Hat advisory RHSA-2010:0114 and Secunia advisory SA38639 as referenced by NVD, the Exploit-DB entries 11787 and 16670, and the antivirus detection families published by Microsoft, F-Secure and Kaspersky. The Adobe bulletin page did not render for retrieval, so no reporter credit is asserted. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-680 is used for the integer-overflow-to-buffer-overflow the vector describes — decoding a malformed TIFF embedded in a PDF overflows a buffer in the bundled libTIFF, which the public exploits characterise as an integer overflow reached from PDF image parsing.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-03-03 with a 2022-03-24 due date and recorded ransomware use as Known - CISA names no family, and none should be inferred. The documented in-the-wild use is commodity rather than targeted: malicious PDFs exploiting CVE-2010-0188 were a standard payload of the Blackhole exploit kit, delivered by drive-by download from compromised sites, SEO poisoning and malicious spam links. Multiple antivirus vendors carry dedicated detection families for the exploit itself - Microsoft's Exploit:Win32/CVE-2010-0188.A, F-Secure's Exploit:W32/CVE-2010-0188.B and .C, and Kaspersky's Exploit.Win32.CVE-2010-0188 - which is the clearest published evidence of sustained volume. No named campaign and no actor attribution is carried by the sources consulted.",
@@ -28368,7 +28960,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Microsoft's July 2017 security update acknowledgements credit 'Haifei Li of the McAfee Security Team' for this vulnerability. That is vendor-adjacent security research rather than an independent report or a bug-bounty submission. No AI involvement is claimed and none is plausible for a 2017 disclosure.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from the Microsoft July 2017 Security Updates CVRF (release 2017-07-11, severity Important, acknowledgement to Haifei Li of the McAfee Security Team), the MSRC advisory for CVE-2017-8570, NVD, the CISA KEV entry of 2022-02-25, Exploit-DB 44263 by Rich Warren, the rxwx/CVE-2017-8570 repository, and Zscaler's reporting on Lokibot malspam. NVD notes this CVE is distinct from CVE-2017-0243, and it is frequently confused with CVE-2017-0199, a different moniker flaw fixed three months earlier. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-829 is used for the inclusion of functionality from an untrusted control sphere the vector describes — Office resolves a document-supplied composite moniker that binds a scriptlet moniker and executes the .sct it names, without the checks that constrain what an embedded object may be.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-02-25 with a 2022-08-25 due date and records the ransomware association as Unknown. Exploitation is commodity rather than a single named campaign, and it long outlived the July 2017 fix: Zscaler documented malspam campaigns delivering Lokibot through malicious RTF documents chaining CVE-2017-8570 with CVE-2018-0802, Trend Micro published a customer advisory on the CVE downloading high-profile malware families, and Juniper ships a dedicated IPS signature, HTTP:STC:MS-CVE-2017-8570-RCE. Microsoft's own vulnerability record still carries Exploited:No from the July 2017 assessment, which is the state at release and not a current judgement — the KEV listing supersedes it. No named threat-actor group is attributed to this CVE in the sources reviewed, and none should be inferred from the malware families it delivered.",
@@ -29288,7 +29880,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found in the wild by Kaspersky's sandbox detection in late April 2018, with 360 independently analysing it per 0patch's credit line. Sandbox detonation is automated triage of live samples, not AI-assisted vulnerability discovery, and no source consulted credits any AI or ML tooling with finding the flaw.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2018-8174 (CWE-787), the MSRC advisory, Kaspersky's Securelist analysis by Boris Larin (2018-07-03, discovery late April 2018), the 0patch micropatch write-up of 2018-05-15 crediting Kaspersky and 360, Exploit-DB 44741, and CISA KEV (added 2022-02-15, ransomware use Known).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Kaspersky detected the exploit in the wild in late April 2018 through its sandbox and reported it to Microsoft; Boris Larin published the technical analysis on Securelist on 2018-07-03. 0patch's write-up credits both Kaspersky and 360 with in-the-wild discovery and analysis, so two vendors independently found it in live attacks. CISA added the CVE to KEV on 2022-02-15 with a 2022-08-15 due date and records ransomware use as **Known** - the only entry in this chunk that does - but no ransomware family is named by CISA or by any source consulted, and none is asserted here. A public repository named orf53975/Rig-Exploit-for-CVE-2018-8174 redistributes exploit-kit code under the Rig name; that establishes the existence of the repository, not an independently confirmed Rig campaign, and it is recorded on that basis. Kaspersky's technical analysis names no threat actor or campaign.",
@@ -29993,8 +30585,8 @@
       ]
     },
     "ai_discovered": false,
-    "ai_discovery_notes": "Apple credits the report to 'an anonymous researcher' in all three advisories and gives no affiliation, so the discovery route cannot be characterised — the source is recorded as unknown rather than assumed human. Project Zero's analysis is post-patch root-cause work by Maddie Stone and is not the discovery. No AI-assisted discovery is claimed by any party, and no evidence for one exists either way.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_notes": "Apple credits the report to 'an anonymous researcher' in all three advisories and gives no affiliation, so the reporter is outside Apple but unnamed, and the discovery route is not described. Project Zero's analysis is post-patch root-cause work by Maddie Stone and is not the discovery. No AI-assisted discovery is claimed by any party, and no evidence for one exists either way.",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from Apple's advisories HT213091 (Safari 15.3), HT213092 (macOS Monterey 12.2.1) and HT213093 (iOS/iPadOS 15.3.1), all dated 2022-02-10, the Google Project Zero 0-days-in-the-wild root-cause analysis for CVE-2022-22620, the CISA KEV entry of 2022-02-11, and the springsec/CVE-2022-22620 repository. ai_discovery_source is set to unknown rather than human_researcher because Apple's 'an anonymous researcher' credit does not establish the route.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's advisories for iOS 15.3.1 and iPadOS 15.3.1, macOS Monterey 12.2.1 and Safari 15.3, all released 2022-02-10, each carry the sentence 'Apple is aware of a report that this issue may have been actively exploited' — Apple's standard formulation, which asserts a report rather than a confirmed campaign. CISA added the CVE to KEV the following day, 2022-02-11, with a 2022-02-25 due date and ransomware association Unknown. No named campaign, threat actor or victim set is public. Apple credits 'an anonymous researcher' and names no reporting vendor, so there is not even an attribution chain to reason from; Project Zero states it had no access to the exploit sample, which is why its 2022 write-up analyses the patch and the 2016 regression rather than the operator. Nothing in the reviewed sources supports naming a mercenary-spyware vendor or a state operator for this CVE, and none should be inferred from the year or the platform. EPSS is 0.16214 at the 96.8th percentile on 2026-08-28.",
@@ -30230,7 +30822,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed in March 2020 through a documentation-leak sequence around the March 2020 Patch Tuesday rather than through an AI-assisted research programme; Microsoft's response was advisory ADV200005 on 2020-03-10 followed by the out-of-band fix KB4551762 on 2020-03-12. No AI tooling is credited in Microsoft's advisory or in the subsequent vendor analyses.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2020-0796 (CWE-119, CVSS 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), CISA KEV (added 2022-02-10, due 2022-08-10, ransomware Known), Microsoft's MSRC record for CVE-2020-0796 and advisory ADV200005, and the public exploit record on Exploit-DB (48267, 48537) and Rapid7's Metasploit modules.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2022-02-10 with a 2022-08-10 due date, and records knownRansomwareCampaignUse as Known. That ransomware flag is CISA's own determination and is the sole source for it in this record: no primary vendor or government report naming a specific ransomware family or operator for CVE-2020-0796 was found at curation time, and this entry deliberately names none. Microsoft published advisory ADV200005 on 2020-03-10 after the vulnerability was disclosed ahead of a patch, and shipped the fix as KB4551762 on 2020-03-12. Public reporting through 2020 described broad opportunistic scanning and malware families incorporating the vulnerability, with declining sample volume as the affected builds were patched or retired.",
@@ -30671,7 +31263,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Oracle in the Critical Patch Update advisory of October 2017. Oracle's credit-statements page was not retrieved, so no finder is named here. The date precedes AI-assisted vulnerability discovery and no AI tooling is credited in any source consulted.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-10271 (CWE-306, CVSS 3.1 base 7.5, Oracle-supplied vector), the Oracle Critical Patch Update advisory of October 2017, CISA KEV (added 2022-02-10, ransomware Known), the vulhub reproduction environment, the projectdiscovery Nuclei template, and Exploit-DB 43924. No reporter is named because Oracle's acknowledgement page was not read.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-02-10 with a 2022-08-10 due date - a six-month window rather than the usual fortnight - and recorded ransomware use as Known; CISA names no family and none should be inferred. The documented in-the-wild use is mass, opportunistic and financially motivated rather than targeted: from late 2017 into 2018, operators scanned for exposed /wls-wsat/ endpoints and installed cryptocurrency mining software, with Monero miners on unpatched WebLogic servers the pattern reported by multiple vendors. Publication of a proof of concept on 2017-12-23 marks the start of the volume. No named campaign and no actor codename is carried by the sources consulted.",
@@ -30902,7 +31494,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found by FireEye as an in-the-wild zero-day during 2017 threat research, after Microsoft's April 2017 disabling of EPS prompted continued scrutiny of the filter. No AI or ML tooling is credited in the report, and the discovery method described is analysis of live attack samples.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-0262 (no CWE assigned), the MSRC advisory for this CVE, FireEye's EPS-processing zero-days report of 2017-05-09 (APT28 attribution, GAMEFISH payload, CVE-2017-0263 chaining, lure hash and C2), Microsoft security advisory ADV170005, and CISA KEV (added 2022-02-10). CWE assigned editorially: NVD records no weakness for this CVE, so CWE-843 is used for the type confusion the vector describes — the EPS interpreter accesses a forged procedure object as an incompatible type, which the `forall` operator turns into control of the operand stack.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "FireEye's report of 2017-05-09 attributes CVE-2017-0262 to APT28, a Russian cyber-espionage group, targeting European diplomatic and military entities, and states it delivered the GAMEFISH payload. The named lure is Trump's_Attack_on_Syria_English.docx, MD5 f8e92d8b5488ea76c40601c8f1a08790, with C2 at wmdmediacodecs.com; FireEye records the EPS bug as chained with CVE-2017-0263 for privilege escalation and sandbox escape. FireEye distinguishes this from the contemporaneous CVE-2017-0261, a use-after-free on the `restore` operand used by Turla and by an unnamed financially motivated group with SHIRIME and NETWIRE payloads - the two are separate flaws and should not be conflated. FireEye also records that it detected this second EPS vulnerability after Microsoft disabled EPS in the April 2017 Patch Tuesday. CISA added the CVE to KEV on 2022-02-10 with a 2022-08-10 due date and records ransomware use as Unknown; no ransomware family is named.",
@@ -31870,7 +32462,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed in Microsoft's January 2022 update cycle. No AI tooling is credited in Microsoft's advisory, in Unit 42's analysis or in Google Project Zero's root-cause analysis, and the public exploits are hand-written data-only win32k code building on the CVE-2021-1732 technique.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2022-21882 (CWE-787, CVSS 7.8 AV:L/AC:L/PR:L/UI:N), CISA KEV (added 2022-02-04, due 2022-02-18, ransomware Known), Microsoft's MSRC record for CVE-2022-21882, Palo Alto Unit 42's win32k exploitation analysis of CVE-2022-21882 and CVE-2021-1732, Google Project Zero's 0days-in-the-wild root-cause analysis, and Rapid7's Metasploit module exploit/windows/local/cve_2022_21882_win32k.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft shipped the fix in the January 2022 update cycle (2022-01-11). CISA added the CVE to KEV on 2022-02-04 with a 2022-02-18 due date — fourteen days — and records knownRansomwareCampaignUse as Known. Google Project Zero includes CVE-2022-21882 in its 0-days-in-the-wild root-cause-analysis collection and states the analysts had the exploit sample, which is the strongest public evidence of real-world use. Public reporting in late January 2022 (BleepingComputer, SecurityAffairs) described social-media reports of in-the-wild exploitation alongside multiple public exploit releases. No named campaign or threat actor is attributed to CVE-2022-21882 in Microsoft's advisory or in Project Zero's analysis; the BITTER APT name that appears in the Metasploit module's author field is a research-credit line inherited from the CVE-2021-1732 work and is not an attribution of this CVE's exploitation. No specific ransomware family is named in any of the sources checked — the ransomware flag is CISA's determination.",
@@ -32549,7 +33141,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by FireEye as an in-the-wild zero-day and disclosed on 2014-04-26. No AI or ML tooling is credited in CERT/CC's note or in any source consulted; the discovery method described is analysis of live targeted attacks.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-1776 (CWE-416, exploited in the wild April 2014, including Microsoft's VGX.DLL clarification), CERT/CC vulnerability note VU#222929, Microsoft security advisory 2963983 and bulletin MS14-021, and CISA KEV (added 2022-01-28). FireEye is the disclosing party per CERT/CC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "NVD records the flaw 'as exploited in the wild in April 2014'. FireEye publicly disclosed it on 2014-04-26 and CERT/CC's VU#222929 references the campaign as Operation Clandestine Fox, noting it targeted even legacy Windows XP systems - which is the detail that mattered publicly, because XP had reached end of support on 2014-04-08 and Microsoft nonetheless shipped it an update. Microsoft published security advisory 2963983 with interim guidance and then bulletin MS14-021 out of band. CISA added the CVE to KEV on 2022-01-28 with a 2022-07-28 due date and records ransomware use as Unknown; no ransomware family and no threat-actor name beyond the campaign designation appears in the sources consulted, and no state attribution is asserted here.",
@@ -33269,7 +33861,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found by Jonathan Bar Or, a Microsoft security researcher, during threat-hunting on Log4j exploitation activity rather than through code review, fuzzing or a bounty submission. That is vendor security research, at a vendor other than the affected one. No AI-assisted discovery is claimed by Microsoft or SolarWinds.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from the SolarWinds trust-centre advisory for CVE-2021-35247 and the Serv-U 15.3 release documentation, NVD, the CISA KEV entry of 2022-01-21, and Microsoft's finding as reported by Help Net Security including Jonathan Bar Or's own description of the behaviour. The specific request shape used against affected instances was never published by Microsoft or SolarWinds, so no exploitation payload is recorded here.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-21 with a 2022-02-04 due date and records the ransomware association as Unknown. The discovery and the exploitation are the same event: Microsoft security researcher Jonathan Bar Or was analysing Log4j exploitation activity in December 2021 and noticed attacks coming from serv-u.exe, which led to the finding that Serv-U would build an LDAP query from unsanitized input — so the attackers reached the flaw before the vendor did. No named campaign, threat actor group or victim set is public, and the actors are described only as opportunistic Log4j exploitation traffic. SolarWinds' own position is that no downstream effect was detected because the LDAP servers ignored the improper characters, and that the Log4j attempts against Serv-U failed because the product does not use Log4j; neither statement contradicts the KEV listing, which is about the input-validation flaw being exercised in the wild rather than about the Log4j payloads succeeding. EPSS is 0.03453 at the 88th percentile on 2026-08-28 — a moderate rank on a low absolute score, consistent with a flaw that is being probed but has no published exploit.",
@@ -34149,7 +34741,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The advisory GHSA-2m8v-572m-ff2v was published on 2021-02-14 by sebhildebrandt, the package maintainer, and the page retrieved credits no external reporter or researcher. No AI or ML tooling is named in the advisory, the NVD record, or the fix commit, and the defect class - an array bypassing a string sanitiser - is a code-reading result rather than a fuzzing crash.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-21315 (CWE-78, published 2021-02-16), the vendor advisory GHSA-2m8v-572m-ff2v (published 2021-02-14 by sebhildebrandt, no external reporter credited), the fix commit 07daa05fb06f24f96297abaa30c2ace8bfd8b525, the NetApp advisory ntap-20210312-0007, CISA KEV (added 2022-01-18), and the projectdiscovery Nuclei template http/cves/2021/CVE-2021-21315.yaml.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-18 with a 2022-02-01 due date - fourteen days - and records ransomware use as Unknown. CISA's own catalogue text is the only exploitation narrative located: 'an attacker can send a malicious payload that will exploit the name parameter'. No named campaign, threat actor, malware family or vendor incident report connecting exploitation to this CVE was found in the sources consulted, and none should be inferred from the KEV listing. What can be stated about the exploitation environment is that tooling was widely available well before the listing: the ForbiddenProgrammer PoC repository was created 2021-03-01, roughly two weeks after the 2021-02-16 NVD publication, and a Nuclei template ships in the default template set, so opportunistic internet-wide scanning for the getServices route is the expected background activity.",
@@ -34826,7 +35418,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "VMSA-2021-0020 states that the vulnerabilities it covers 'were privately reported to VMware' and carries per-CVE acknowledgements; the acknowledgement text for CVE-2021-22017 was not recoverable from the advisory content reviewed, so no individual credit is asserted here. No AI-assisted discovery is claimed by VMware or by any reporter.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from VMware advisory VMSA-2021-0020.2 (issued 2021-09-21, updated 2025-12-05) including its full response matrix, NVD, the CISA KEV entry of 2022-01-10, the projectdiscovery/nuclei-templates entry http/cves/2021/CVE-2021-22017.yaml, and GreyNoise's reporting on the CVE-2021-22005 chain as covered by SecurityWeek. The reporter for this specific CVE could not be sourced from the advisory content reviewed and is therefore left unstated rather than guessed. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-647 is used for the authorization decision taken on a non-canonical URL path that the vector describes — rhttpproxy decides from the request path which internal endpoint may be reached, and normalises `..;/` segments differently from the backend it forwards to.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-01-24 due date and records the ransomware association as Unknown. The exploitation reporting is about the chain rather than this CVE alone: GreyNoise observed attacks chaining CVE-2021-22005, the critical vCenter arbitrary-file-upload flaw from the same VMSA-2021-0020 advisory, with CVE-2021-22017 as the proxy bypass that reaches its endpoint — the reachability that VMware's own text describes as 'internal endpoints being accessed'. No named campaign, threat actor group or victim count is public for this CVE. Note the divergence in how badly it was scored: NVD assigns 5.3 with confidentiality-low only, while VMware assigns 7.3 with low impact across confidentiality, integrity and availability and rates it Important — the vendor's higher score is the better guide to why it was listed. EPSS is 0.49177 at the 98.8th percentile on 2026-08-28, which is far above what the base score alone would suggest and is consistent with a flaw whose value is compositional.",
@@ -41579,7 +42171,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco published the defect in its own September 2017 bundled IOS advisory set under bug ID CSCuz47179 and credits no outside reporter, which places discovery inside Cisco's engineering and PSIRT process. Neither the advisory nor NVD's reference set indicates automated or AI-assisted discovery, and no research arm - AI-branded or otherwise - is named.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12235 (CWE-20, CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-profinet (Cisco bug ID CSCuz47179). Cisco scores the same defect 8.6 on its own advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-profinet states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' That is vendor-documented activity carried in a revision of the 2017 advisory, contemporaneous with the CISA KEV enrollment on 2022-03-03. Cisco characterises it as attempted exploitation and names no threat actor, campaign, victim set or geography. CISA records no known ransomware use.",
@@ -41682,7 +42274,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The defect appears in Cisco's own September 2017 bundled IOS advisory under bug ID CSCvc43709 with no external reporter credited, placing discovery inside Cisco's engineering and PSIRT process. Nothing in the advisory or in NVD's references points to fuzzing infrastructure, automated analysis or AI assistance of any kind.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12234 (CWE-20, CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-cip (Cisco bug ID CSCvc43709). The advisory covers a second CIP defect, CVE-2017-12233, under bug ID CSCuz95334.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-cip states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' Note the scope of that sentence before relying on it: the advisory covers two distinct CIP defects - CVE-2017-12234 under Cisco bug ID CSCvc43709 and CVE-2017-12233 under CSCuz95334 - and the exploitation statement is written in the singular without being broken out per bug ID, so it establishes vendor-observed activity against the CIP surface described by this advisory rather than against one bug ID specifically. The observation is contemporaneous with the KEV enrollment on 2022-03-03. No actor, campaign or victim set is named, and CISA records no known ransomware use.",
@@ -41785,7 +42377,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco carries the defect under its own bug ID CSCuz95334 in a bundled advisory with no external credit, which places the finding inside Cisco's engineering and PSIRT process. No fuzzing harness, automated analysis pipeline or AI-assisted tooling is named by Cisco or in NVD's reference set, and no research group with 'AI' in its brand name appears in the record.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12233 (CWE-20, CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-cip (Cisco bug ID CSCuz95334). The same advisory carries CVE-2017-12234 under bug ID CSCvc43709 as a separate defect.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's cisco-sa-20170927-cip advisory records that 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' Read the attribution carefully before scoping an investigation from it: that advisory covers CVE-2017-12233 (CSCuz95334) and CVE-2017-12234 (CSCvc43709) together and the sentence is not broken out by bug ID, so what Cisco documents is observed activity against the CIP surface the advisory describes, not a per-defect confirmation. The observation lands alongside the KEV enrollment on 2022-03-03. Cisco names no actor and no victim set; CISA records no known ransomware use.",
@@ -41888,7 +42480,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco published the defect under its own bug ID CSCvc03809 in the September 2017 bundled IOS advisory set with no external reporter credited, which places it in Cisco's engineering and PSIRT process. An internal-only protocol between a router and its own service blades is not a surface an outside researcher typically reaches, which is consistent with vendor-side discovery. Nothing in the advisory or NVD's references names automated analysis or AI assistance.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12232 (CVSS 6.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-rbip-dos (Cisco bug ID CSCvc03809). CWE assigned editorially: NVD's only weakness assignment is CWE-399, which MITRE renders as 'CWE CATEGORY: Resource Management Errors' and marks PROHIBITED for vulnerability mapping on the grounds that 'This entry is a Category', so CWE-20 is used here for misclassification of a frame on the internal blade protocol.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-rbip-dos states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' This advisory covers only CVE-2017-12232, so unlike a bundled multi-CVE advisory the statement attaches unambiguously to this defect. The activity is vendor-documented and concurrent with the KEV enrollment on 2022-03-03; Cisco characterises it as attempted exploitation and identifies no actor, campaign, sector or geography. CISA records no known ransomware use. Note what adjacency implies for any resulting investigation: an attempt against this defect was made by something already inside a segment attached to the router.",
@@ -41991,7 +42583,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco tracks the defect under its own bug ID CSCvc57217 in the September 2017 bundled IOS advisory set and credits no outside reporter, placing the finding inside Cisco's engineering and PSIRT process. Neither the advisory nor NVD's reference set names a fuzzing harness, automated analysis or AI-assisted tooling, and no research group with 'AI' in its name is involved.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12231 (CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-nat (Cisco bug ID CSCvc57217). CWE assigned editorially: NVD's only weakness assignment is CWE-399, a MITRE Category — its page renders 'CWE CATEGORY: Resource Management Errors' and marks vulnerability-mapping usage PROHIBITED because 'This entry is a Category' — so CWE-20 is used here for improper translation of H.323 RAS messages by the NAT application layer gateway.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-nat states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' Cisco's own page confirms that the advisory references only CVE-2017-12231, so the statement attaches to this defect alone rather than to a bundle. The activity is vendor-documented and contemporaneous with the CISA KEV enrollment on 2022-03-03. Cisco names no actor, campaign or victim set and describes the activity as attempted rather than successful; CISA records no known ransomware use.",
@@ -58533,7 +59125,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The bulletin records the flaw as not publicly disclosed but exploited in the wild, indicating Microsoft identified the in-the-wild activity itself; discovery was human vendor research, with no AI-assisted analysis claimed.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-0149 (CWE-787, CVSS 8.8) + CISA KEV (added 2022-05-24, ransomware: Unknown) + Microsoft advisory MS17-006, which records Exploited: Yes / Publicly disclosed: No.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft's MS17-006 (2017-03-14) marks CVE-2017-0149 as Exploited: Yes at release. CISA added it to KEV on 2022-05-24 (due 2022-06-14); KEV ransomware use Unknown.",
@@ -63265,9 +63857,9 @@
       "_ioc_source_note": "The vulnerable routine (IOMFB::TableCompensator::BilerpGainTable::new_from_data), the AppleCLCD external method 78 reachable from the app sandbox, and the 'element modified after free' panic with attacker-controlled 0x4141414141414141 data are read from Saar Amar's published analysis at https://saaramar.github.io/IOMFB_integer_overflow_poc/ and the accompanying code at https://github.com/saaramar/IOMFB_integer_overflow_poc; that write-up records its testing on an iPhone X at iOS 14.7.1 (18G82), an iPhone 11 Pro at 14.7.1 and 15.0 and an iPhone 11 Pro Max at 15.0, and names no silicon generation, so the panic indicator is stated for those builds rather than for a chip list. The fixed build numbers are from the NVD description of CVE-2021-30883 and Apple's advisory set (HT212846 and companions). No network or file signature is asserted: Apple published no indicators for the in-the-wild report, and inventing one for an on-device kernel primitive would be fabrication."
     },
     "ai_discovered": false,
-    "ai_discovery_notes": "Apple's advisory for iOS and iPadOS 15.0.2 ends the IOMobileFrameBuffer entry with 'CVE-2021-30883: an anonymous researcher' — so a finder is credited but is unnamed, and nothing published says how the issue reached Apple or what relationship it has to the exploitation report in the same entry. That unnamed credit is why the discovery route is recorded as unknown rather than assigned. Saar Amar's contribution came after the patch, by diffing Apple's fix, which is post-disclosure analysis rather than discovery. No AI-assisted discovery or triage is claimed anywhere; the published analysis is manual reverse engineering of the patched binary.",
-    "ai_discovery_source": "unknown",
-    "discovery_attribution_note": "Curated from NVD CVE-2021-30883 (CWE-787, CVSS 7.8) + CISA KEV (added 2022-05-23) + Apple advisories HT212846, HT212868, HT212869, HT212872, HT212874 and HT212876; mechanism confirmed against Saar Amar's post-patch bindiff and PoC. Apple credits 'an anonymous researcher' for the issue, so the finder is unnamed and the discovery route is recorded as unknown.",
+    "ai_discovery_notes": "Apple's advisory for iOS and iPadOS 15.0.2 ends the IOMobileFrameBuffer entry with 'CVE-2021-30883: an anonymous researcher' — so a finder is credited but is unnamed, and nothing published says how the issue reached Apple or what relationship it has to the exploitation report in the same entry. Saar Amar's contribution came after the patch, by diffing Apple's fix, which is post-disclosure analysis rather than discovery. No AI-assisted discovery or triage is claimed anywhere; the published analysis is manual reverse engineering of the patched binary.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Curated from NVD CVE-2021-30883 (CWE-787, CVSS 7.8) + CISA KEV (added 2022-05-23) + Apple advisories HT212846, HT212868, HT212869, HT212872, HT212874 and HT212876; mechanism confirmed against Saar Amar's post-patch bindiff and PoC. Apple credits 'an anonymous researcher' for the issue, so the finder is outside Apple but unnamed.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's own advisory language is the evidence: 'Apple is aware of a report that this issue may have been actively exploited', published alongside iOS 15.0.2 on 2021-10-11 across HT212846 and the companion notes for macOS Monterey 12.0.1, iOS 14.8.1, tvOS 15.1, watchOS 8.1 and macOS Big Sur 11.6.1. CISA added the CVE to KEV on 2022-05-23 with a 2022-06-13 due date and the ransomware field Unknown. Apple credits the issue to 'an anonymous researcher' and names no actor, publishes no indicators and says nothing about who filed the exploitation report, and no named-actor attribution from a threat-intel vendor was resolvable — so what an operator can say is that a kernel escalation reachable from the app sandbox was in someone's chain in autumn 2021, and nothing more specific.",
     "attack_refs": [
@@ -76226,7 +76818,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by SAP in Security Note 3084487 as part of the August 2021 SAP Security Patch Day; the finding traces to SAP's own product security handling rather than an outside disclosure that is publicly attributed. No AI-assisted discovery is claimed or evidenced.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-38163 (CWE-22, CVSS 8.8; SAP self-scored 9.9) + CISA KEV (added 2022-06-09) + SAP Security Note 3084487. Public exploit code: purpleteam-ru and core1impact GitHub repositories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2021-38163 to KEV on 2022-06-09 (due 2022-06-30), which is CISA's assertion of confirmed in-the-wild exploitation. KEV records the ransomware campaign use as Unknown. SAP-focused attacker interest in unrestricted-upload-to-RCE on internet-exposed NetWeaver portals is long-standing.",
@@ -78207,7 +78799,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Check Point (advisory sk185169) after in-the-wild exploitation was observed. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-16232 (CWE-287, CVSS 9.1) + CISA KEV (added 2026-07-22) + Check Point advisory sk185169.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Check Point confirmed active exploitation affecting a small number of customers at disclosure on 22 July 2026; CISA added it to KEV the same day with a three-day remediation due date (2026-07-25). Attackers reaching an internet-exposed Management Server without Trusted Clients restrictions can obtain admin tokens and rewrite firewall security policy, making it a management-plane takeover primitive.",
@@ -80099,7 +80691,7 @@
     "poc_available": false,
     "ai_discovered": false,
     "ai_discovery_notes": "Apple addressed the issue via a Rapid Security Response after learning of a report of active exploitation. The advisory does not credit external attribution or any AI tooling.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-37450 (CVSS 8.8) + CISA KEV (added 2023-07-13) + Apple vendor advisories (HT213826/HT213841/HT213843/HT213846/HT213848).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple stated it was aware of a report that this WebKit issue may have been actively exploited, and shipped it as an out-of-band Rapid Security Response; CISA added it to KEV on 2023-07-13. Exploitation requires luring a target to attacker-controlled web content (UI:R), consistent with targeted mobile-device attacks rather than mass exploitation. No detailed public PoC or technical writeup was released.",
@@ -81462,7 +82054,7 @@
     "poc_available": false,
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Samsung in the SMR Mar-2021 Release 1 security maintenance release; addressed through Samsung's mobile security process. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-25371 (CWE-912, CVSS 6.7) + CISA KEV (added 2023-06-29) + Samsung Mobile security advisory (security.samsungmobile.com).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA lists it as known-exploited (KEV added 2023-06-29). It is one of a cluster of Samsung DSP/display driver flaws fixed in the March 2021 SMR that were abused as privilege-escalation primitives in a commercial-surveillance Android exploit chain against Exynos devices; note that the publicly analysed Project Zero chain (CVE-2021-25337/25369/25370) documents sibling bugs from the same release rather than a standalone public exploit for 25371 specifically.",
@@ -84805,7 +85397,7 @@
     "rwep_notes": "RWEP 64. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +14, patch_available -15. Σ factors === rwep_score."
   },
   "CVE-2014-0196": {
-    "name": "Linux Kernel Race Condition Vulnerability",
+    "name": "Linux Kernel Race Condition Vulnerability (CVE-2014-0196)",
     "cvss_score": 5.5,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
     "cwe_refs": [
@@ -88938,7 +89530,7 @@
     "poc_description": "No public standalone PoC identified. Mandiant documented the China-nexus group UNC3886 using the crafted-CLI-command path traversal to write files to FortiGate firmware for implant persistence, but exploitation required existing super-admin access and no drop-in exploit is public.",
     "ai_discovered": false,
     "ai_discovery_notes": "Surfaced through Fortinet/Mandiant incident-response investigation of UNC3886 intrusions. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-41328 (CWE-22, CVSS 7.1) + CISA KEV (added 2023-03-14) + Fortinet advisory FG-IR-22-369.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Confirmed exploited in highly targeted attacks by the China-nexus actor UNC3886, which used the path traversal to write files to FortiGate devices and maintain persistence (THINCRUST/CASTLETAP implants) with super-admin privileges. KEV-listed 2023-03-14; exploitation was espionage, not ransomware.",
@@ -89166,7 +89758,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Stephen Fewer of Rapid7. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-27198 (CWE-288, CVSS 9.8) + CISA KEV (added 2024-03-07) + JetBrains security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited within days of the March 2024 Rapid7 disclosure; CISA KEV flags known ransomware use. Attackers chained the bypass to create admin accounts and upload malicious plugins for RCE on internet-facing CI/CD servers.",
@@ -89257,7 +89849,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Attributed to an anonymous reporter via Apple's coordinated process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23225 (CWE-787, CVSS 7.8) + CISA KEV (added 2024-03-06) + Apple security advisories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple acknowledged a report of active exploitation. Used as the kernel-protection-bypass stage of a targeted exploit chain: an attacker who already holds arbitrary kernel read/write defeats memory-protection mitigations to gain reliable kernel control.",
@@ -89354,7 +89946,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Attributed to an anonymous reporter via Apple's coordinated process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23296 (CWE-787, CVSS 7.8) + CISA KEV (added 2024-03-06) + Apple security advisories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple acknowledged a report of active exploitation. Affects the RTKit real-time OS; used as a kernel-protection-bypass stage for an attacker already holding arbitrary kernel read/write, consistent with a targeted exploit chain.",
@@ -89452,7 +90044,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Android's security process (bug A-251586912). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-21237 (CWE-200, CVSS 5.5) + CISA KEV (added 2024-03-05) + Android Pixel bulletin 2023-06-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV for the Android Pixel Framework component. A locally-installed malicious app can hide its foreground-service notification, concealing background activity (e.g. surveillance) and enabling local information disclosure without user awareness.",
@@ -89545,7 +90137,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by NCC Group. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-36380 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-03-05) + NCC Group technical advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in March 2024 for in-the-wild exploitation; EPSS ~0.98. Unauthenticated attackers inject shell metacharacters to run commands as root, enabling DoS, botnet enrollment, or persistence on the network device.",
@@ -89637,7 +90229,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Jan Vojtesek of Avast, who observed Lazarus in-the-wild use. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21338 (CWE-822, CVSS 7.8) + CISA KEV (added 2024-03-04) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by the Lazarus Group (DPRK) as an admin-to-kernel primitive to install the FudModule rootkit and disable EDR; CISA KEV flags known ransomware association. Abuses an exposed IOCTL in appid.sys (the AppLocker driver) to achieve a read/write primitive.",
@@ -89729,7 +90321,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft via coordinated disclosure (Luca Ginex / researchers). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29360 (CWE-822, CVSS 8.4) + CISA KEV (added 2024-02-29) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV for in-the-wild exploitation. The Microsoft Streaming Service Proxy driver (mskssrv.sys) untrusted-pointer dereference lets a local attacker escalate to SYSTEM; public exploits make it a reliable post-compromise LPE.",
@@ -89821,7 +90413,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Cisco via its PSIRT process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-3259 (CWE-200, CVSS 7.5) + CISA KEV (added 2024-02-15) + Cisco Security Advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Leveraged by the Akira ransomware group to extract credentials from internet-facing Cisco ASA/FTD AnyConnect/WebVPN appliances; CISA KEV flags known ransomware use. A crafted GET request to the web services interface returns device memory that can contain cleartext usernames and passwords, seeding initial access.",
@@ -89913,7 +90505,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Addressed by Microsoft enabling Extended Protection by default in Exchange CU14. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21410 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-02-15) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing Exchange Servers; CISA KEV confirms in-the-wild use. An attacker coerces/relays a victim's NTLM credentials to Exchange Web Services, impersonating the victim and escalating privileges when Extended Protection is not enforced.",
@@ -90008,7 +90600,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Peter Girnus and researchers at Trend Micro ZDI (Water Hydra tracking). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21412 (CWE-693, CVSS 8.1) + CISA KEV (added 2024-02-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by the Water Hydra (DarkCasino) actor and in DarkGate campaigns to bypass SmartScreen/Mark-of-the-Web and deliver malware; CISA KEV flags known ransomware association. A crafted internet shortcut chains to a second shortcut on a network share so the payload runs without a SmartScreen warning.",
@@ -90100,7 +90692,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by security researchers (MSRC-credited); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21351 (CWE-94, CVSS 7.6) + CISA KEV (added 2024-02-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day in February 2024; crafted internet-shortcut files defeated Mark-of-the-Web so SmartScreen skipped its reputation check, delivering follow-on malware. Adjacent to the Water Hydra / DarkMe campaign that abused the sibling SmartScreen bypass CVE-2024-21412. KEV ransomware use unconfirmed.",
@@ -90195,7 +90787,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fix and disclosure via the Roundcube project; exploitation documented by ESET. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-43770 (CWE-79, CVSS 6.1) + CISA KEV (added 2024-02-12) + Roundcube 1.6.3 security release.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Winter Vivern (TA473) espionage group against European governmental webmail from at least October 2023; a crafted plain-text email link executed script in the victim's Roundcube session to steal mail and credentials. KEV ransomware use unconfirmed.",
@@ -90290,7 +90882,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Chrome's vulnerability process; exploitation attributed to a commercial-surveillance chain. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4762 (CWE-843, CVSS 8.8) + CISA KEV (added 2024-02-06) + Google Chrome stable-channel advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A V8 type-confusion in Chrome/Chromium exploited in the wild for arbitrary code execution via a crafted HTML page; associated with commercial-surveillance targeting and later flagged as exploited. Client-side and requires the victim to visit an attacker page. KEV ransomware use unconfirmed.",
@@ -90477,7 +91069,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Ivanti; exploitation analysis by Rapid7 and others. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21893 (CWE-918, CVSS 8.2) + CISA KEV (added 2024-01-31, ransomware=known) + Ivanti security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited from late January 2024 against internet-facing Ivanti Connect Secure / Policy Secure gateways; the SAML-component SSRF is chained with CVE-2024-21887 command injection for unauthenticated RCE, bypassing the initial mitigation. KEV flags known ransomware use, alongside nation-state and criminal exploitation. EPSS ~1.0.",
@@ -90575,7 +91167,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Atlassian; PoC/exploitation analysis by Rapid7 and ProjectDiscovery. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-22527 (CWE-74, CVSS 9.8) + CISA KEV (added 2024-01-24, ransomware=known) + Atlassian advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited from January 2024 against internet-facing Confluence Data Center and Server; the unauthenticated OGNL template injection yields RCE and was used to deploy cryptominers, Sliver C2 and webshells. KEV flags known ransomware use. EPSS ~1.0.",
@@ -90764,7 +91356,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by VMware; long-running exploitation attributed to UNC3886 by Mandiant. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-34048 (CWE-787, CVSS 9.8) + CISA KEV (added 2024-01-22) + VMware VMSA-2023-0023.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the China-nexus espionage group UNC3886 since approximately 2021 — years before the October 2023 disclosure — to reach ESXi hosts and deploy VIRTUALPITA/VIRTUALPIE implants. Network-facing, unauthenticated, RCE-class. KEV ransomware use unconfirmed. EPSS ~0.99.",
@@ -90859,7 +91451,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Rapid7 while investigating CVE-2023-35078; disclosed by Ivanti. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-35082 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-01-18, ransomware=known) + Ivanti security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (CISA-confirmed January 2024) against internet-facing Ivanti EPMM / MobileIron Core MDM servers; unauthenticated attackers reach restricted API endpoints to read user PII and make server changes, and it can be chained toward RCE. KEV flags known ransomware use. EPSS ~1.0.",
@@ -90954,7 +91546,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Chrome's vulnerability process; Google withheld exploit detail while patches propagated. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-0519 (CWE-787/CWE-125, CVSS 8.8) + CISA KEV (added 2024-01-17) + Google Chrome stable-channel advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day (January 2024); an out-of-bounds memory access in V8 reachable from a crafted HTML page allows heap corruption and potential code execution in the renderer. Client-side and requires visiting an attacker page. KEV ransomware use unconfirmed.",
@@ -91045,7 +91637,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Cloud Software Group / Citrix PSIRT after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-6549 (CWE-119, CVSS 7.5) + CISA KEV (added 2024-01-17) + Citrix security bulletin CTX584986.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day disclosed alongside CVE-2023-6548 on 16 Jan 2024; the out-of-bounds read on NetScaler appliances configured as a Gateway (VPN/ICA Proxy/CVPN/RDP Proxy) or AAA virtual server crashes the packet-processing engine, removing remote access for the whole estate. CISA KEV ransomware flag: unknown.",
@@ -91141,7 +91733,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Cloud Software Group / Citrix PSIRT after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-6548 (CWE-94, CVSS 8.8) + CISA KEV (added 2024-01-17) + Citrix security bulletin CTX584986.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day disclosed 16 Jan 2024 alongside CVE-2023-6549; a low-privileged authenticated user with access to the NetScaler management interface (NSIP, CLIP, or SNIP) achieves remote code execution on the appliance. CISA KEV ransomware flag: unknown.",
@@ -91240,7 +91832,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Object-injection gadget-chain research (phpggc, Ambionics/community) with fix in Laravel 5.6.30. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2018-15133 (CWE-502, CVSS 8.1) + CISA KEV (added 2024-01-16) + Laravel 5.6.30 upgrade advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited: attackers harvest Laravel APP_KEY values leaked through exposed .env files or prior compromise, then forge an encrypted X-XSRF-TOKEN whose decrypted payload is unserialized into a PHP object-injection gadget chain for remote code execution. CISA KEV ransomware flag: unknown.",
@@ -91334,7 +91926,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Nguyen Tien Giang (Jang) of STAR Labs, demonstrated at Pwn2Own Vancouver 2023. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29357 (CWE-303, CVSS 9.8) + CISA KEV (added 2024-01-10, ransomware: known) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited and CISA-flagged as ransomware-associated; an unauthenticated attacker who obtains a spoofed JWT bypasses authentication to gain SharePoint administrator privileges, and it chains with CVE-2023-24955 for unauthenticated RCE (the STAR Labs Pwn2Own Vancouver 2023 chain).",
@@ -91427,7 +92019,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered in-the-wild and reported by Volexity with Ivanti/Mandiant; state-linked exploitation (UTA0178). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46805 (CWE-287, CVSS 8.2) + CISA KEV (added 2024-01-10, ransomware: known) + Ivanti forums advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited zero-day (CISA-flagged ransomware-associated); a remote unauthenticated attacker uses directory traversal in the web component to bypass control checks and reach restricted endpoints, and chains with CVE-2024-21887 command injection for unauthenticated RCE across the Ivanti Connect Secure / Policy Secure fleet.",
@@ -91524,7 +92116,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered in-the-wild and reported by Volexity with Ivanti/Mandiant; state-linked exploitation (UTA0178). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21887 (CWE-77, CVSS 9.1) + CISA KEV (added 2024-01-10, ransomware: known) + Ivanti forums advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited zero-day (CISA-flagged ransomware-associated); an authenticated administrator sends crafted requests to the ICS/IPS web components to execute arbitrary commands, and when chained with the CVE-2023-46805 auth bypass it becomes fully unauthenticated RCE used to drop webshells (e.g. GIFTEDVISITOR, WIREFIRE) across the fleet.",
@@ -91620,7 +92212,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Joomla project (Zewei Zhang / community) and fixed in 4.2.8. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-23752 (CWE-284, CVSS 5.3) + CISA KEV (added 2024-01-08) + Joomla Security Centre advisory 894-20230201.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (CISA KEV); an improper access check on Joomla! 4.x REST endpoints lets an unauthenticated attacker read configuration, including MySQL database credentials, which is then used for lateral access. CISA KEV ransomware flag: unknown.",
@@ -91713,7 +92305,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Public exploit since 2016; adopted by IoT botnets. D-Link addressed via end-of-life/replacement notice SAP10088. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2016-20017 (CWE-77, CVSS 9.8) + CISA KEV (added 2024-01-08) + D-Link support announcement SAP10088.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild from 2016 through 2022, primarily by IoT botnets (Mirai/Moobot-class), which use unauthenticated command injection via the login.cgi cli parameter to enlist DSL-2750B routers. The device line is end-of-life and unpatched. CISA KEV ransomware flag: unknown.",
@@ -91805,7 +92397,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Kaspersky (Operation Triangulation) and patched by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41990 (no NVD CWE; classified out-of-bounds write CWE-787; CVSS 7.8) + CISA KEV (added 2024-01-08) + Apple advisory HT213599 (and companion HT213601/HT213605/HT213606).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-click 0-day in the Operation Triangulation iPhone espionage campaign (Kaspersky): a malicious iMessage attachment processes a font using an undocumented Apple-only ADJUST TrueType instruction to achieve code execution against iOS versions before 15.7.1. Espionage-motivated; CISA KEV ransomware flag: unknown.",
@@ -91904,7 +92496,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Naveen Sunkavally (Horizon3.ai); fixed in Superset 2.1.0, which refuses to start on a default SECRET_KEY. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-27524 (CWE-1188, CVSS 9.8) + CISA KEV (added 2024-01-08) + Apache Superset security advisory (lists.apache.org).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (CISA KEV); attackers use one of Apache Superset's shipped default SECRET_KEY values to forge a signed session cookie, authenticate as an administrator, and then leverage admin access (database connections / SQL Lab / charts) toward remote code execution. CISA KEV ransomware flag: unknown.",
@@ -91997,7 +92589,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe and fixed in APSB23-40; ProjectDiscovery published subsequent gadget-chain analysis. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29300 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-01-08) + Adobe APSB23-40.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild against internet-facing Adobe ColdFusion servers since mid-2023 to drop web shells; CISA KEV flags associated ransomware use. EPSS is in the top percentile (~1.0).",
@@ -92092,7 +92684,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Surfaced via ProjectDiscovery research (a new gadget chain Adobe fixed out-of-band in APSB23-41). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-38203 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-01-08) + Adobe APSB23-41.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A denylist-bypass zero-day in ColdFusion's deserialization, disclosed inadvertently and fixed by Adobe out-of-band; exploited in the wild alongside the other 2023 ColdFusion flaws, with ransomware association per CISA KEV.",
@@ -92189,7 +92781,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified by Barracuda with Mandiant during Barracuda ESG (UNC4841) incident response. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-7101 (CWE-95/CWE-94, CVSS 7.8) + CISA KEV (added 2024-01-02) + GitHub advisory GHSA-3c85-mx4x-435c.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by China-nexus actor UNC4841 against Barracuda Email Security Gateway appliances (late-December 2023 wave) by mailing crafted Excel attachments; the flaw lives in the widely embedded Spreadsheet::ParseExcel Perl module rather than a single product.",
@@ -92375,7 +92967,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Akamai SIRT during the InfectedSlurs botnet investigation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-49897 (CWE-78, CVSS 8.8) + CISA KEV (added 2023-12-21) + FXC advisory (2023-12-06).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Mirai-variant 'InfectedSlurs' botnet (reported by Akamai SIRT) to conscript FXC AE1021/AE1021PE wall routers into a DDoS swarm; authenticated command injection over the network.",
@@ -92471,7 +93063,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Akamai SIRT during the InfectedSlurs botnet investigation; QNAP published QSA-23-48. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-47565 (CWE-78, CVSS 8.8) + CISA KEV (added 2023-12-21) + QNAP advisory QSA-23-48.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the InfectedSlurs Mirai-variant botnet (Akamai SIRT) against legacy QNAP VioStor NVR devices on QVR firmware 4.x, enrolling them into a DDoS botnet; authenticated command injection over the network.",
@@ -92567,7 +93159,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Surfaced through coordinated disclosure and CISA/EPA incident response to the CyberAv3ngers water-sector attacks; documented in the Unitronics advisory. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-6448 (CWE-1188/CWE-798, CVSS 9.8) + CISA KEV (added 2023-12-11) + Unitronics Cybersecurity Advisory 2023-001.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by the Iran-affiliated CyberAv3ngers against internet-exposed Unitronics Vision/Samba PLCs and HMIs in late 2023, including U.S. water-utility systems (e.g. Aliquippa, PA), by logging in with the publicly known factory default password; CISA/EPA issued alerts.",
@@ -92662,7 +93254,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Praetorian (ZeroQlik research). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41266 (CWE-22, CVSS 6.5) + CISA KEV (added 2023-12-07) + Qlik community security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Chained with CVE-2023-41265 for unauthenticated RCE and used as initial access by Cactus ransomware against internet-facing Qlik Sense Enterprise for Windows (observed by Arctic Wolf); CISA KEV flags ransomware use.",
@@ -92760,7 +93352,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Praetorian (ZeroQlik research). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41265 (CWE-444, CVSS 9.9) + CISA KEV (added 2023-12-07) + Qlik community security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "The privilege-escalation link of the ZeroQlik chain: combined with CVE-2023-41266 it gives unauthenticated RCE on Qlik Sense Enterprise for Windows and was used by Cactus ransomware for initial access (Arctic Wolf); CISA KEV flags ransomware use.",
@@ -92858,7 +93450,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Qualcomm flagged limited, targeted exploitation based on indications from Google's Threat Analysis Group / Project Zero; fixed via the December 2023 bulletin. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33107 (CWE-190, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm December 2023 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Qualcomm flagged this Adreno GPU (Graphics/kgsl) integer-overflow memory-corruption issue as under limited, targeted in-the-wild exploitation (December 2023 bulletin), consistent with a local privilege-escalation stage in mobile exploit chains; affects a broad range of Qualcomm chipsets.",
@@ -92950,7 +93542,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Exploitation identified and reported by Google Threat Analysis Group and Google Project Zero. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33106 (CWE-823, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm December 2023 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Flagged by Google Threat Analysis Group and Google Project Zero as being under limited, targeted exploitation against Android devices; Qualcomm confirmed exploitation and issued OEM guidance. Ransomware use not observed (targeted-spyware pattern).",
@@ -93041,7 +93633,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Exploitation reported by Google Threat Analysis Group and Google Project Zero. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33063 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm December 2023 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Named by Google Threat Analysis Group and Google Project Zero as being under limited, targeted exploitation alongside the Adreno GPU flaws; Qualcomm confirmed and issued OEM guidance. No ransomware association (targeted-spyware pattern).",
@@ -93132,7 +93724,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Qualcomm's security bulletin; subsequent exploitation flagged by Google Threat Analysis Group/Project Zero. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2022-22071 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm May 2022 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV alongside the other Qualcomm chipset flaws that Google TAG/Project Zero flagged as under limited, targeted exploitation. No ransomware association reported.",
@@ -93223,7 +93815,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Apple / Google Threat Analysis Group (Clement Lecigne). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42917 (CWE-787, CVSS 8.8) + CISA KEV (added 2023-12-04) + Apple security advisory HT214031.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple confirmed a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.1 — a targeted-spyware exploitation pattern. No ransomware association.",
@@ -93317,7 +93909,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Clement Lecigne of Google Threat Analysis Group. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42916 (CWE-125, CVSS 6.5) + CISA KEV (added 2023-12-04) + Apple security advisory HT214031.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple confirmed a report that this issue may have been exploited against versions of iOS before iOS 16.7.1; it is the information-disclosure companion to the WebKit code-execution zero-day patched in the same release. No ransomware association.",
@@ -93505,7 +94097,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by ownCloud PSIRT. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-49103 (CWE-200, CVSS 7.5) + CISA KEV (added 2023-11-30) + ownCloud security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited within days of disclosure by automated scanning (EPSS ~0.78, 99th percentile); listed in CISA KEV. Exposed container environment variables including ownCloud admin password, mail credentials, and license keys. No specific ransomware attribution, but harvested credentials enable follow-on intrusion.",
@@ -93607,7 +94199,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by the Qualys Threat Research Unit. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4911 (CWE-122, CVSS 7.8) + CISA KEV (added 2023-11-21) + Qualys 'Looney Tunables' advisory and distribution security updates.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Known as 'Looney Tunables'; added to CISA KEV after confirmed exploitation, including by the Kinsing threat actor for privilege escalation in cloud/Linux environments to deploy cryptominers. Ubiquitous exposure on Linux systems using a vulnerable glibc. No ransomware association, but LPE enables broad post-access impact.",
@@ -93700,7 +94292,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft and remediated in the October 2023 update; associated with RomCom/Storm-0978 activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36584 (Windows MOTW security-feature bypass, CVSS 5.4) + CISA KEV (added 2023-11-16) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as part of phishing intrusion chains (associated with RomCom / Storm-0978 activity) to suppress Mark-of-the-Web so that SmartScreen/Protected View warnings do not trigger on downloaded files. Limited direct impact on its own; potent as a delivery-stage evasion. No ransomware association in this component.",
@@ -93794,7 +94386,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Sophos and fixed in 4.3.10.4. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-1671 (CWE-77, CVSS 9.8) + CISA KEV (added 2023-11-16) + Sophos advisory SA-20230404-SWA-RCE.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV as actively exploited; EPSS ~1.0 (top percentile) reflecting widespread exploitation attempts. Pre-authentication command injection gives full remote code execution on internet-facing appliances; the product is end-of-life, raising the risk of unpatched exposed instances. No specific ransomware attribution.",
@@ -93887,7 +94479,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Oracle's Critical Patch Update (Jan 2020); researcher-reported through Oracle's coordinated program. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-2551 (deserialization via IIOP, CVSS 9.8) + CISA KEV (added 2023-11-16) + Oracle CPU Jan 2020 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-11-16; the IIOP-facing WLS Core Components flaw has been mass-scanned and weaponized since the Jan-2020 Oracle CPU, remaining a durable initial-access vector against internet-exposed WebLogic. EPSS 0.93 (99.8th pct). Ransomware use unconfirmed but common on WebLogic footholds.",
@@ -93980,7 +94572,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft after in-the-wild detection (credited to Quan Jin / DBAPPSecurity WeBin Lab in the MSRC advisory). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36033 (CWE-822/CWE-119, CVSS 7.8) + CISA KEV (added 2023-11-14) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day and patched in the Nov 2023 Patch Tuesday; the attacker used a novel technique to escalate from the Window Manager\\DWM account to SYSTEM. Tracked by Google Project Zero's 0days-in-the-wild. Ransomware use unconfirmed. EPSS 0.12 (95.7th pct) reflects it being a post-foothold LPE, not a mass-scanned preauth flaw.",
@@ -94075,7 +94667,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft after in-the-wild detection (credited to multiple researchers in the MSRC advisory). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36025 (SmartScreen security-feature bypass, CVSS 8.8) + CISA KEV (added 2023-11-14) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild via crafted Internet Shortcut (.url) files that suppress Defender SmartScreen prompts; abused by Phemedrone Stealer, DarkGate, and Mispadu campaigns. Patched Nov 14 2023. EPSS 0.88 (99.7th pct). No ransomware attribution but heavily used as a malware-delivery enabler.",
@@ -94167,7 +94759,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36036 (CWE-122/CWE-787, CVSS 7.8) + CISA KEV (added 2023-11-14) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day and patched in Nov 2023; a low-privilege attacker escalates to SYSTEM through a heap-based overflow in the Cloud Files Mini Filter Driver (cldflt.sys). Ransomware use unconfirmed. EPSS 0.17 (96.7th pct) reflects a post-foothold LPE rather than a mass-scanned preauth flaw.",
@@ -94358,7 +94950,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36844 (CWE-473, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the actively-exploited Juniper J-Web pre-auth RCE chain (with CVE-2023-36845/36846/36847); exploitation attempts were observed from Aug 25 2023, about a week after Juniper's patch and watchTowr's PoC. Alone it is a preauth PHP environment-variable modification (partial integrity loss) that is chained upward. EPSS 0.91 (99.8th pct). Ransomware use unconfirmed.",
@@ -94459,7 +95051,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); RCE weaponized publicly by watchTowr Labs (single-request variant later shown by VulnCheck). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36845 (CWE-473, CVSS 9.8) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "The critical RCE anchor of the Juniper J-Web chain: by setting the PHPRC environment variable via a crafted request an unauthenticated attacker loads a malicious PHP config and executes code. Exploitation observed from Aug 25 2023, ~a week after patch and watchTowr's PoC; ~12,000 SRX/EX devices were reported internet-exposed. EPSS 0.94 (99.8th pct). Ransomware use unconfirmed.",
@@ -94563,7 +95155,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36846 (CWE-306, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the actively-exploited Juniper J-Web pre-auth RCE chain; an unauthenticated request to user.php uploads arbitrary files via J-Web on SRX Series, providing the file-write primitive combined with CVE-2023-36845 for RCE. Exploitation observed from Aug 25 2023. EPSS 0.94 (99.8th pct). Ransomware use unconfirmed.",
@@ -94665,7 +95257,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36847 (CWE-306, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the actively-exploited Juniper J-Web pre-auth RCE chain; an unauthenticated request to installAppPackage.php uploads arbitrary files via J-Web on EX Series, providing the file-write primitive that chains toward RCE. Exploitation observed from Aug 25 2023. EPSS 0.85 (99.7th pct). Ransomware use unconfirmed.",
@@ -94767,7 +95359,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36851 (CWE-306, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the Juniper J-Web pre-auth chain; an unauthenticated request to webauth_operation.php allows uploading and downloading arbitrary files on SRX Series, giving both a file-write primitive (for RCE chaining) and arbitrary-file read. CISA KEV'd 2023-11-13. Its EPSS is far lower (0.011, 61.7th pct) than the sibling CVEs, reflecting narrower standalone weaponization. Ransomware use unconfirmed.",
@@ -94868,7 +95460,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by BitSight (Pedro Umbelino) and Curesec. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29552 (no NVD CWE assigned, CVSS 7.5) + CISA KEV (added 2023-11-08) + BitSight/Curesec SLP disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA-KEV listed; SLP-enabled hosts reachable on UDP/427 are abused as reflectors/amplifiers to launch spoofed-source DDoS with amplification factors reported above 2000x. No ransomware association.",
@@ -94962,7 +95554,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported and disclosed by Atlassian PSIRT. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-22518 (CWE-863, CVSS 9.8) + CISA KEV (added 2023-11-07) + Atlassian advisory CONFSERVER-93142.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited shortly after disclosure; the Cerber ransomware crew and other actors used it to reset instances and seize admin control. CISA-KEV flags known ransomware use. Confluence Cloud (atlassian.net) is not affected.",
@@ -95061,7 +95653,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and disclosed by the Apache ActiveMQ project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46604 (CWE-502, CVSS 9.8) + CISA KEV (added 2023-11-02) + Apache ActiveMQ security announcement.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Heavily exploited in the wild against internet-exposed OpenWire brokers (TCP/61616) to deploy ransomware (HelloKitty, TellYouThePass) as well as Kinsing, SparkRAT and cryptominers. CISA-KEV flags known ransomware use.",
@@ -95159,7 +95751,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Michael Weber and Thomas Hendrickson of Praetorian; disclosed by F5. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46748 (CWE-89, CVSS 8.8) + CISA KEV (added 2023-10-31) + F5 advisory K000137365.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild, typically chained with the CVE-2023-46747 authentication bypass to reach the Configuration utility unauthenticated and then run system commands. CISA-KEV ransomware status unknown.",
@@ -95258,7 +95850,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Michael Weber and Thomas Hendrickson of Praetorian; disclosed by F5. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46747 (CWE-288/CWE-306, CVSS 9.8) + CISA KEV (added 2023-10-31) + F5 advisory K000137353.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as the unauthenticated entry point (via AJP/mod_proxy request smuggling to the internal Tomcat) that reaches the Configuration utility to run system commands, commonly chained with CVE-2023-46748. CISA-KEV flags known ransomware use.",
@@ -95357,7 +95949,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "In-the-wild exploitation reported by ESET (Matthieu Faou); fixed by the Roundcube project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-5631 (CWE-79, CVSS 5.4) + CISA KEV (added 2023-10-26) + Roundcube 1.6.4/1.5.5/1.4.15 release advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild by the Winter Vivern (TA473) espionage group against government webmail targets: a crafted SVG in an HTML email ran JavaScript in the victim's Roundcube session to exfiltrate mail. CISA-KEV ransomware status unknown.",
@@ -95548,7 +96140,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Citrix; root cause reverse-engineered and published by Assetnote (Dylan Pindur). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4966 (CWE-119, CVSS 7.5) + CISA KEV (added 2023-10-18) + Citrix advisory CTX579459.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Widely exploited as 'Citrix Bleed': a buffer over-read leaks session tokens from NetScaler memory, letting attackers hijack authenticated sessions and bypass MFA. Mass-exploited by LockBit and other ransomware/extortion actors; CISA-KEV flags known ransomware use.",
@@ -95742,7 +96334,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe by external researchers credited in APSB23-01. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-21608 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-10-10) + Adobe advisory APSB23-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild against Adobe Acrobat/Reader users: opening a malicious PDF triggers a use-after-free yielding arbitrary code execution as the current user. CISA-KEV ransomware status unknown.",
@@ -95929,7 +96521,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by security researcher Gerald Doussot (NCC Group) / independent research (Frycos). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41763 (CWE-918, CVSS 5.3) + CISA KEV (added 2023-10-10) + Microsoft MSRC advisory for CVE-2023-41763.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed and actively exploited; EPSS is very high (0.90), consistent with widespread internet scanning of on-prem Skype for Business Server. No ransomware association is recorded.",
@@ -96019,7 +96611,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft via coordinated disclosure (credited in the October 2023 update guide). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36563 (CWE-20, CVSS 5.5) + CISA KEV (added 2023-10-10) + Microsoft MSRC advisory for CVE-2023-36563.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed and actively exploited; the flaw discloses NTLM credential material and can be chained into relay/authentication attacks. No ransomware association is recorded.",
@@ -96211,7 +96803,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Progress by Assetnote (Shubham Shah and Sean Yeoh) research. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-40044 (CWE-502, CVSS 8.8) + CISA KEV (added 2023-10-05, ransomware: known) + Progress WS_FTP Server September 2023 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed with a known ransomware association; EPSS ~0.90. Public exploitation followed rapidly after Assetnote's disclosure, targeting internet-facing WS_FTP Server Ad Hoc Transfer modules.",
@@ -96302,7 +96894,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Addressed by Apple as an actively-exploited issue; Apple did not publicly credit an external reporter. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42824 (no NVD CWE assigned, CVSS 7.8) + CISA KEV (added 2023-10-05) + Apple advisory HT213972.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple acknowledged a report that this kernel flaw may have been actively exploited against versions of iOS before iOS 16.6, consistent with targeted mobile-surveillance use. No ransomware association is recorded.",
@@ -96399,7 +96991,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to JetBrains by Sonar (Stefan Schiller) research. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42793 (CWE-288, CWE-306, CVSS 9.8) + CISA KEV (added 2023-10-04, ransomware: known) + JetBrains TeamCity post-mortem advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild by nation-state actors (Russia's APT29 and North Korea's Lazarus/Diamond Sleet) against internet-facing TeamCity servers; CISA KEV flags a known ransomware association and EPSS is ~0.9998. TeamCity's CI role makes it a supply-chain pivot point.",
@@ -96491,7 +97083,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by @k0shl of Cyber Kunlun. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-28229 (CWE-591, CVSS 7.0) + CISA KEV (added 2023-10-04) + Microsoft MSRC advisory for CVE-2023-28229.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed as actively exploited; the flaw yields limited SYSTEM privileges from a low-privileged local context. No ransomware association is recorded.",
@@ -96583,7 +97175,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported to Arm by Maddie Stone (Google Threat Analysis Group) and Jann Horn (Google Project Zero). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4211 (CWE-416, CVSS 5.5) + CISA KEV (added 2023-10-03) + Arm Mali GPU Driver Vulnerabilities advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Arm warned the flaw may be under limited, targeted exploitation; Google TAG attributed in-the-wild use to a commercial surveillance (spyware) vendor. The affected Mali GPU kernel drivers are present across a very large Android device population. No ransomware association is recorded.",
@@ -96770,7 +97362,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Red Hat Product Security (CVE-2018-14667). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2018-14667 (CWE-94, CVSS 9.8) + CISA KEV (added 2023-09-28) + Red Hat RHSA-2018:3517.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-28; the RichFaces UserResource EL-injection deserialization chain is exploited against internet-facing JBoss/JSF applications for unauthenticated RCE (EPSS ~0.74). KEV ransomware status: unknown.",
@@ -96866,7 +97458,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Bill Marczak (Citizen Lab) and Maddie Stone (Google Threat Analysis Group); fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41991 (CWE-295, CVSS 5.5) + CISA KEV (added 2023-09-25) + Apple HT213927/HT213931.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One link of the Predator/Intellexa commercial-spyware exploit chain (with CVE-2023-41992 and CVE-2023-41993) reported by Citizen Lab and Google TAG; Apple confirmed active exploitation against iOS before 16.7. KEV ransomware status: unknown.",
@@ -96962,7 +97554,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Bill Marczak (Citizen Lab) and Maddie Stone (Google Threat Analysis Group); fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41992 (CWE-754, CVSS 7.8) + CISA KEV (added 2023-09-25) + Apple HT213927/HT213932.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Kernel LPE used as the privilege-escalation stage of the Predator/Intellexa spyware chain (with CVE-2023-41991 and CVE-2023-41993), reported by Citizen Lab and Google TAG; Apple confirmed active exploitation against iOS before 16.7. KEV ransomware status: unknown.",
@@ -97055,7 +97647,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Bill Marczak (Citizen Lab) and Maddie Stone (Google Threat Analysis Group); fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41993 (CWE-754, CVSS 8.8) + CISA KEV (added 2023-09-25) + Apple HT213940.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "WebKit RCE that served as the browser-based entry point of the Predator/Intellexa spyware chain (with CVE-2023-41991/41992); reported by Citizen Lab and Google TAG; Apple confirmed active exploitation against iOS before 16.7. Impact extends to non-Apple products embedding WebKit. KEV ransomware status: unknown.",
@@ -97145,7 +97737,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Handled by Trend Micro PSIRT after observed in-the-wild exploitation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41179 (CWE-94, CVSS 7.2) + CISA KEV (added 2023-09-21) + Trend Micro solution 000294994.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day before the fix; CISA added it 2023-09-21. Requires prior administrative-console access, then abuses the 3rd-party AV uninstaller module to run arbitrary commands on the affected Trend Micro management install. KEV ransomware status: unknown.",
@@ -97242,7 +97834,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported and fixed by the MinIO maintainers via GitHub Security Advisory GHSA-2pxw-r47w-4p8c. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-28434 (CWE-269, CVSS 8.8) + CISA KEV (added 2023-09-19) + MinIO GHSA-2pxw-r47w-4p8c.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-19; exploited in the wild and frequently chained with CVE-2023-28432 to escalate from limited credentials to arbitrary object writes on internet-exposed MinIO consoles. KEV ransomware status: unknown.",
@@ -97330,7 +97922,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Samsung Mobile Security in the January 2022 SMR. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2022-22265 (CWE-703, CVSS 7.8) + CISA KEV (added 2023-09-18) + Samsung Mobile Security bulletin (SMR Jan-2022 Release 1).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-18; the Samsung Exynos NPU driver flaw allows arbitrary kernel memory write and code execution from a local context and has been used in targeted device-compromise chains. Very low EPSS reflects no commodity exploit. KEV ransomware status: unknown.",
@@ -97421,7 +98013,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by security researchers and fixed by affected OEMs (e.g., D-Link SAP10055). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-8361 (no NVD CWE; command injection, CVSS 9.8) + CISA KEV (added 2023-09-18) + D-Link SAP10055 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild through 2023 (EPSS ~0.9998); the Realtek SDK miniigd SOAP RCE is a staple of Mirai/Gafgyt-class IoT botnets targeting the vast population of consumer routers/IoT devices embedding the SDK. Added to CISA KEV 2023-09-18. KEV ransomware status: unknown.",
@@ -97515,7 +98107,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by an independent researcher; Zyxel published a security advisory for the EMG2926-Q10A. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-6884 (CWE-78, CVSS 8.8) + CISA KEV (added 2023-09-18) + Zyxel EMG2926-Q10A security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-18 and flagged as leveraged in ransomware campaigns (KEV ransomware: known). The Zyxel EMG2926 nslookup diagnostic command injection is exploited by botnets against exposed SOHO routers. EPSS ~0.38.",
@@ -97609,7 +98201,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Charles Fol (Ambionics Security); fixed in Ignition 2.5.2. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-3129 (no NVD CWE; code injection via insecure file operations, CVSS 9.8) + CISA KEV (added 2023-09-18) + Facade Ignition advisory / Ambionics writeup.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-18 and flagged as leveraged in ransomware campaigns (KEV ransomware: known). The Laravel Ignition debug-mode RCE (EPSS ~0.999) is mass-exploited against internet-facing Laravel apps left in debug mode.",
@@ -97702,7 +98294,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe and fixed in APSB23-34; exploited in the wild. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-26369 (CWE-787, CVSS 7.8) + CISA KEV (added 2023-09-14) + Adobe APSB23-34.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day before Adobe's September 2023 fix; a victim must open a malicious PDF, yielding arbitrary code execution in the current user's context. CISA added it to KEV on 2023-09-14.",
@@ -97794,7 +98386,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Google in the Android Framework; noted as under limited targeted exploitation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-35674 (CWE-269, CVSS 7.8) + CISA KEV (added 2023-09-13) + Android Security Bulletin 2023-09-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Android Security Bulletin flagged this as under limited, targeted exploitation before the September 2023 fix. A malicious installed app launches a background activity via a WindowState logic error to escalate privilege with no user interaction. CISA added it to KEV on 2023-09-13.",
@@ -97888,7 +98480,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco PSIRT published the advisory after incident responders observed Akira ransomware actors abusing ASA/FTD RA VPN. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-20269 (CWE-288/CWE-863, CVSS 9.1) + CISA KEV (added 2023-09-13, ransomware known) + Cisco advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by Akira (and other) ransomware operators for initial access against Cisco ASA/FTD remote-access VPNs lacking MFA; KEV flags ransomware use as known. The AAA-separation flaw lets an unauthenticated attacker brute-force valid credentials against a default tunnel group, and lets a clientless SSL VPN session be established on ASA 9.16 and earlier.",
@@ -97983,7 +98575,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at the University of Toronto's Munk School. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4863 (CWE-787, CVSS 8.8) + CISA KEV (added 2023-09-13) + Google Chrome stable-channel advisory (crbug 1479274).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited zero-day (reported by Apple SEAR and Citizen Lab) in the BLASTPASS-adjacent wave; a crafted WebP image triggers a heap buffer overflow in libwebp's Huffman-table decoder, reachable from any renderer that decodes WebP. EPSS ~0.997. CISA added it to KEV on 2023-09-13.",
@@ -98075,7 +98667,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and fixed by Microsoft; exploited in the wild. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36761 (CWE-20, CVSS 6.5) + CISA KEV (added 2023-09-12) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day patched by Microsoft in September 2023. Opening — or merely previewing in the Preview Pane — a crafted Office/Word document forces an outbound authentication that leaks the victim's NetNTLM hash to an attacker-controlled host, enabling relay or offline cracking. CISA added it to KEV on 2023-09-12.",
@@ -98171,7 +98763,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Credited to researchers including Valentina Palmiotti (IBM X-Force), Quan Jin (DBAPPSecurity), and Google Threat Analysis Group / Mandinet reporting; fixed by Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36802 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-09-12) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day (analyzed by Google Project Zero's in-the-wild program) and patched by Microsoft in September 2023. A use-after-free / type confusion in the mskssrv kernel driver lets a local low-privileged process elevate to NT AUTHORITY\\SYSTEM. CISA added it to KEV on 2023-09-12.",
@@ -98265,7 +98857,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by The Citizen Lab at the University of Toronto's Munk School while analyzing an actively-exploited device; fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41064 (CWE-120, CVSS 7.8) + CISA KEV (added 2023-09-11) + Apple HT213905.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Zero-click zero-day discovered by The Citizen Lab as the BLASTPASS chain (with CVE-2023-41061) used to deliver NSO Group's Pegasus spyware to iPhones. A maliciously crafted image processed by ImageIO overflows a buffer, leading to arbitrary code execution. CISA added it to KEV on 2023-09-11.",
@@ -98360,7 +98952,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by The Citizen Lab while analyzing an actively-exploited device; fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41061 (CWE-20, CVSS 7.8) + CISA KEV (added 2023-09-11) + Apple HT213905/HT213907.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Zero-click zero-day discovered by The Citizen Lab as the second half of the BLASTPASS chain (with CVE-2023-41064) delivering NSO Group's Pegasus. A validation flaw in Wallet lets a maliciously crafted attachment achieve arbitrary code execution. CISA added it to KEV on 2023-09-11.",
@@ -98453,7 +99045,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and fixed by the Apache RocketMQ project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33246 (CWE-94, CVSS 9.8) + CISA KEV (added 2023-09-06) + Apache RocketMQ advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited preauth RCE; the DreamBus botnet weaponized it against internet-exposed RocketMQ brokers. NameServer/Broker/Controller components exposed to the extranet lack permission verification, so an attacker uses the update-configuration function (or forges the RocketMQ protocol) to run commands as the RocketMQ service user. EPSS ~0.966. CISA added it to KEV on 2023-09-06.",
@@ -98547,7 +99139,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Group-IB during investigation of in-the-wild attacks; fixed by RARLAB in WinRAR 6.23. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-38831 (CWE-345/CWE-351, CVSS 7.8) + CISA KEV (added 2023-08-24, ransomware known) + RARLAB WinRAR 6.23 release notes.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild April–October 2023 (initially by financially-motivated actors against traders, later by state-linked groups); KEV flags ransomware use as known. A ZIP/RAR archive pairs a benign file with a same-named folder whose executable contents run when the victim opens the decoy in WinRAR before 6.23. EPSS ~0.978. CISA added it to KEV on 2023-08-24.",
@@ -98636,7 +99228,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Coordinated disclosure via Microsoft MSRC. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-58644 (CWE-502, CVSS 9.8) + CISA KEV (added 2026-07-16) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-16 with a 3-day due date, indicating confirmed active exploitation of internet-facing SharePoint servers. Ransomware use is not yet confirmed but deserialization RCE on SharePoint has historically been chained into web-shell drops and hands-on-keyboard intrusion.",
@@ -98728,7 +99320,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Fortinet PSIRT (FG-IR-26-141). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-25089 (CWE-78, CVSS 9.8) + CISA KEV (added 2026-07-16) + Fortinet PSIRT advisory FG-IR-26-141.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2026-07-16 with a 3-day BOD 26-04 deadline; honeypot telemetry and threat-intel vendors recorded unauthenticated exploitation attempts against exposed FortiSandbox management UIs since mid-June 2026. Ransomware use not confirmed.",
@@ -98827,7 +99419,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Fortinet PSIRT (FG-IR-26-100). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-39808 (CWE-78, CVSS 9.8) + CISA KEV (added 2026-07-16) + Fortinet PSIRT FG-IR-26-100.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2026-07-16 with a 3-day due date, citing crafted-HTTP-request exploitation of internet-facing FortiSandbox appliances by an unauthenticated attacker. Ransomware use is unconfirmed but the compressed remediation window signals observed active exploitation.",
@@ -98922,7 +99514,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Oracle's May 2026 Critical Patch Update; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-46817 (CWE-269/CWE-287/CWE-306, CVSS 9.8) + CISA KEV (added 2026-07-15) + Oracle Critical Patch Update May 2026 (cspumay2026).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild against internet-facing Oracle E-Business Suite instances; decoy telemetry captured unauthenticated file-read probes (e.g. /etc/passwd via the Payments ibytransmit endpoint) in late June 2026, roughly six weeks after the May 2026 patch. Over 900 EBS instances were reported internet-exposed. CISA KEV ransomware status: Unknown.",
@@ -99026,7 +99618,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through the KNX Association / coordinated ICS disclosure (CISA ICSA-23-236-01). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4346 (CWE-645, CVSS 7.5) + CISA KEV (added 2026-07-15) + CISA ICS advisory ICSA-23-236-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-15 as actively exploited. An attacker with network (or physical) access to a KNX installation using Connection Authorization Option 1 can purge unprotected devices and set a BCU key, permanently locking building-automation controllers out of operator control. Ransomware association is unconfirmed.",
@@ -99115,7 +99707,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Microsoft MSRC as an actively-exploited zero-day. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56155 (CWE-1220, CVSS 7.8) + CISA KEV (added 2026-07-14) + Microsoft MSRC / KB5121391 DKM ACL hardening advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited as a zero-day disclosed in Microsoft's July 2026 Patch Tuesday; ZDI flagged it as the only AD FS bug patched that month under active attack and warned it can be paired with an RCE as commonly seen in ransomware intrusions. Ransomware status listed Unknown by CISA.",
@@ -99210,7 +99802,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported via Mandiant/Google FLARE incident response. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56164 (CWE-306, CVSS 9.8) + CISA KEV (added 2026-07-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Confirmed exploited in the wild as a zero-day before the July 14 2026 patch; discovery credited to Mandiant incident responders and Google's FLARE team, indicating the flaw was found inside active intrusions rather than routine research. CISA added it to KEV the same day with a 3-day due date. Ransomware association: Unknown.",
@@ -99305,7 +99897,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via SonicWall PSIRT (SNWLID-2026-0008). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-15409 (CWE-918, CVSS 10.0) + CISA KEV (added 2026-07-14) + SonicWall PSIRT advisory SNWLID-2026-0008.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-14 under BOD 26-04 with a 3-day due date, indicating observed in-the-wild abuse against internet-facing SonicWall SMA1000 remote-access appliances. CISA's record marks ransomware campaign use as Known, without naming a campaign or an operator.",
@@ -99394,7 +99986,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through SonicWall PSIRT. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-15410 (CWE-94, CVSS 7.2) + CISA KEV (added 2026-07-14) + SonicWall PSIRT advisory SNWLID-2026-0008.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2026-07-14 with a 3-day due date, signalling observed in-the-wild abuse of SMA1000 SSL-VPN appliances, and marks ransomware campaign use as Known without naming a campaign or an operator. Exploitation requires an authenticated administrator session on the Appliance Management Console.",
@@ -99489,7 +100081,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Originally third-party disclosed against Cisco IOS HTTP admin; re-surfaced via CISA KEV. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2008-4128 (CWE-352, CVSS 4.3) + CISA KEV (added 2026-07-13) + Cisco IOS 12.4 end-of-support guidance.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-13 amid renewed exploitation of legacy edge devices; public reporting attributes abuse of this 18-year-old Cisco IOS HTTP-admin CSRF to Russian FSB Center 16-linked actors targeting the retired IOS 12.4 web management interface. Ransomware use not flagged.",
@@ -99586,7 +100178,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Oracle's coordinated disclosure and fixed in the July 2020 Critical Patch Update; researcher-credited, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-14644 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-09-18) + Oracle Critical Patch Update Advisory - July 2020.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-18 as an actively-exploited unauthenticated RCE. WebLogic T3/IIOP deserialization flaws are a persistent target for cryptomining, webshell-drop, and ransomware access brokers; ransomware use is unconfirmed but the class is heavily weaponized.",
@@ -99683,7 +100275,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Oracle by security researcher Peterjson / Jang (VNPT / independent) via Oracle's PSIRT and fixed in the April 2022 CPU. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-21445 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-09-18) + Oracle Critical Patch Update April 2022.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-18 as an actively-exploited unauthenticated RCE in Oracle ADF Faces (Fusion Middleware / WebLogic-hosted). No confirmed ransomware attribution, but internet-facing WebLogic estates are routinely swept for this by opportunistic and access-broker actors.",
@@ -99776,7 +100368,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by MDSec researcher Soroush Dalili (@irsdl). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-0618 (CWE-502, CVSS 8.8) + CISA KEV (added 2024-09-18) + Microsoft MSRC advisory CVE-2020-0618.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-exposed SQL Server Reporting Services instances; a low-privileged authenticated user posts a crafted __VIEWSTATE to a report page to run code as the Report Server service account. CISA's record marks ransomware campaign use as Known; the flaw is a foothold on exposed BI servers rather than the encryption stage itself.",
@@ -99872,7 +100464,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Apache HugeGraph PMC by external security researchers (Aliyun/other reporters credited on the Apache thread). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-27348 (CWE-284, CVSS 9.8) + CISA KEV (added 2024-09-18) + Apache HugeGraph security thread.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-18 after unauthenticated RCE was observed against internet-exposed HugeGraph-Server instances; the near-1.0 EPSS reflects mass opportunistic scanning and exploitation. Ransomware use not confirmed.",
@@ -99963,7 +100555,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Adobe PSIRT following in-the-wild detection by security researchers (FireEye). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-0502 (CWE-415, CVSS 8.8) + CISA KEV (added 2024-09-17) + Adobe APSB14-07.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in February 2014 as a drive-by / watering-hole zero-day (Operation GreedyWonk) against visitors of compromised policy and NGO sites; leveraged for browser-plugin remote code execution. Product is now end-of-life; CISA lists it as discontinue-use.",
@@ -100056,7 +100648,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe during the February 2013 targeted-attack wave; disclosed in bulletin APSB13-08. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-0648 (no NVD CWE; judged CWE-787/CWE-119, CVSS 8.8) + CISA KEV (added 2024-09-17) + Adobe bulletin APSB13-08.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in February 2013 as a zero-day in targeted attacks that lured users to sites serving malicious SWF content. Added to CISA KEV 2024-09-17; the product is end-of-life so the required action is to discontinue use.",
@@ -100147,7 +100739,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe during coordinated disclosure of the February 2013 in-the-wild Flash zero-days. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-0643 (CWE-269, CVSS 8.8) + CISA KEV (added 2024-09-17) + Adobe Security Bulletin APSB13-08.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in February 2013 in targeted attacks delivering crafted SWF content that escaped the Firefox Flash sandbox to run arbitrary code. The product is now end-of-life; CISA lists it as KEV with the required action to discontinue use.",
@@ -100240,7 +100832,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe by Kaspersky Lab following in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-0497 (CWE-191, CVSS 9.8) + CISA KEV (added 2024-09-17) + Adobe APSB14-04.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Discovered as an in-the-wild zero-day by Kaspersky in early 2014; CISA re-listed it on KEV (2024-09-17) with an EoL discontinue-use action. EPSS ~0.999 reflects sustained exploitation, historically via drive-by browser exploitation.",
@@ -100334,7 +100926,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Progress via coordinated disclosure (credited to Sina Kheirkhah of Summoning Team via Trend ZDI); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-6670 (CWE-89, CVSS 9.8) + CISA KEV (added 2024-09-16, ransomware Known) + Progress WhatsUp Gold Security Bulletin August 2024.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited and flagged by CISA KEV as ransomware-associated (ransomware: Known). EPSS is 0.947, among the highest in the batch, reflecting broad exploitation of internet-facing WhatsUp Gold monitoring servers to retrieve encrypted credentials and pivot.",
@@ -100429,7 +101021,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Peter Girnus (Trend Micro Zero Day Initiative); Microsoft confirmed prior in-the-wild exploitation by Void Banshee. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43461 (CWE-451, CVSS 8.8) + CISA KEV (added 2024-09-16) + Microsoft MSRC advisory CVE-2024-43461.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Void Banshee APT before July 2024, chained with CVE-2024-38112 to deliver Atlantida stealer. The MSHTML platform misrepresents the file extension so a malicious HTA is displayed to the victim as a benign PDF. Ransomware association is unconfirmed.",
@@ -100524,7 +101116,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Ivanti PSIRT; technical analysis and PoC by Horizon3.ai. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-8190 (CWE-78, CVSS 7.2) + CISA KEV (added 2024-09-13) + Ivanti CSA security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild within days of disclosure by a suspected nation-state actor (FortiGuard, SecurityWeek), frequently chained with the CSA auth-bypass CVE-2024-8963 to reach the admin console. CISA ransomware status Unknown.",
@@ -100618,7 +101210,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Joe Desimone (Elastic Security Labs). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38217 (CWE-693, CVSS 5.4) + CISA KEV (added 2024-09-10) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild via the 'LNK stomping' technique to strip Mark-of-the-Web tagging so downloaded files bypass Protected View/SmartScreen warnings. Added to CISA KEV 2024-09-10; Elastic Security reported evidence the technique had been abused for months before disclosure. Ransomware association: Unknown.",
@@ -100713,7 +101305,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Michael Baer (SEC Consult Vulnerability Lab) to Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38014 (CWE-269, CVSS 7.8) + CISA KEV (added 2024-09-10) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day and added to CISA KEV 2024-09-10; grants local low-privileged users SYSTEM. Commonly chained after initial access to complete host takeover.",
@@ -100801,7 +101393,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Addressed in Microsoft's September 2024 Patch Tuesday; reporter not publicly credited. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38226 (CWE-693, CVSS 7.3) + CISA KEV (added 2024-09-10) + Microsoft MSRC advisory CVE-2024-38226.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2024-09-10; attackers use it to bypass Office macro-blocking policy so untrusted files execute macros without the expected Mark-of-the-Web/protected-view warnings. No ransomware attribution is recorded, but it is a phishing-chain enabler.",
@@ -100892,7 +101484,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by SonicWall PSIRT (SNWLID-2024-0015). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40766 (CWE-284, CVSS 9.8) + CISA KEV (added 2024-09-09) + SonicWall advisory SNWLID-2024-0015.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited by Akira and Fog ransomware affiliates against internet-facing SonicWall SSL VPN/firewall management, with encryption observed in under an hour of initial access; CISA KEV flags ransomware use as Known. Post-patch migrations that failed to reset local user credentials remained exploitable.",
@@ -100989,7 +101581,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Rediscovered and reported as a security issue by Qualys (the fix commit had landed in April 2015 without being recognized as a security threat). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-1000253 (CWE-119, CVSS 7.8) + CISA KEV (added 2024-09-09, ransomware: Known) + Red Hat / upstream kernel advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-09 with a KEV ransomware flag of 'Known'; the PIE stack-clash-style corruption in load_elf_binary() gives a local attacker root and is a recurring privilege-escalation primitive in post-compromise and ransomware intrusion chains on unpatched long-term kernels.",
@@ -101085,7 +101677,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Nikolay Ermishkin (Mail.Ru Security Team) and Stewie; coordinated via the ImageMagick project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2016-3714 (CWE-20, CVSS 8.4) + CISA KEV (added 2024-09-09) + ImageMagick project advisory / imagetragick.com.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "'ImageTragick' — added to CISA KEV 2024-09-09. ImageMagick is embedded in countless web upload pipelines, so a crafted image processed server-side yields RCE; exploited opportunistically at scale against sites that pass user uploads to ImageMagick delegates. No specific ransomware attribution.",
@@ -101178,7 +101770,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by ESET Research (Romain Dumont) while analyzing APT-C-60 activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7262 (CWE-22, CVSS 9.3) + CISA KEV (added 2024-09-03) + Kingsoft WPS Office update notes + ESET WeLiveSecurity report.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Weaponized as a one-click exploit by the South-Korea-aligned APT-C-60 espionage group: a booby-trapped spreadsheet (uploaded to VirusTotal Feb 2024) triggers promecefpluginhost.exe to load an attacker-supplied DLL, deploying the SpyGlace backdoor. No ransomware association reported.",
@@ -101272,7 +101864,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Tenable Research (TRA-2021-42). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-20124 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-09-03) + Tenable Research Advisory TRA-2021-42.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-03; GreyNoise and Tenable reported active exploitation of internet-exposed VigorConnect management servers, with dozens of source IPs observed reading arbitrary files as root. Ransomware use not confirmed.",
@@ -101371,7 +101963,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Tenable Research (TRA-2021-42). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-20123 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-09-03) + DrayTek VigorConnect security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV amid a global campaign against DrayTek devices; unauthenticated attackers abuse the DownloadFileServlet path traversal to read arbitrary files (e.g. credentials) as root from Internet-exposed VigorConnect management servers. Ransomware use not confirmed.",
@@ -101461,7 +102053,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google (Chrome VRP) by an external researcher; fixed in Chrome 128.0.6613.84. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7965 (CWE-787/CWE-358, CVSS 8.8) + CISA KEV (added 2024-08-28) + Google Chrome stable-channel release notes.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google acknowledged that an exploit for CVE-2024-7965 exists in the wild. Added to CISA KEV 2024-08-28; affects all Chromium-based browsers (Chrome, Edge, Opera), broadening exposure well beyond a single vendor.",
@@ -101555,7 +102147,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by SonicWall Capture Labs threat researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38856 (CWE-863, CVSS 9.8) + CISA KEV (added 2024-08-27) + Apache OFBiz security advisory (lists.apache.org).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (EPSS ~0.994, 99.9th percentile); CISA added it to KEV one day after a public PoC emerged. Unauthenticated attackers reach the ProgramExport endpoint and run Groovy for pre-auth RCE. Ransomware use not confirmed.",
@@ -101654,7 +102246,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Microsoft Threat Intelligence and the Google Chrome security team following in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7971 (CWE-843, CVSS 9.6) + CISA KEV (added 2024-08-26) + Google Chrome stable-channel update + Microsoft Citrine Sleet report.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft attributed exploitation to North Korean threat actor Citrine Sleet, who chained this V8 zero-day with a Windows sandbox-escape to deploy the FudModule rootkit against cryptocurrency targets. Actively exploited as a zero-day before the fix; ransomware not involved.",
@@ -101748,7 +102340,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "In-the-wild exploitation surfaced by Lumen Black Lotus Labs; disclosed by Versa Networks. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-39717 (CWE-434, CVSS 7.2) + CISA KEV (added 2024-08-23) + Versa Networks security bulletin + Lumen Black Lotus Labs reporting.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day since at least June 2024, attributed with moderate confidence to Chinese state-sponsored actors (Volt Typhoon / Bronze Silhouette) who deployed a memory-resident 'VersaMem' web shell against ISPs and MSPs. CISA KEV ransomware status: Unknown.",
@@ -101844,7 +102436,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Microsoft's July 2021 Exchange servicing updates (coordinated researcher reporting in the ProxyOracle/ProxyShell research wave). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-31196 (no NVD CWE; judged CWE-502, CVSS 7.2) + CISA KEV (added 2024-08-21) + Microsoft MSRC advisory CVE-2021-31196.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-21 as actively exploited. A post-authentication remote code execution flaw in Microsoft Exchange Server (part of the ProxyOracle-era Exchange bug set); operators abuse it to run code on internet-facing Exchange and drop web shells. Ransomware association is unconfirmed.",
@@ -101942,7 +102534,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by the Crusaders of Rust CTF team to upstream Linux/distros. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-0185 (CWE-190/191, CVSS 8.4) + CISA KEV (added 2024-08-21) + upstream Linux kernel Filesystem Context fix.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in 2024 after confirmed in-the-wild use; widely leveraged for local privilege escalation and container escape on Linux hosts with unprivileged user namespaces enabled. Ransomware status Unknown.",
@@ -102040,7 +102632,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Dahua PSIRT by an external researcher (bashis). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-33045 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-08-21) + Dahua PSIRT advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Broadly exploited against internet-exposed Dahua IP cameras and NVRs, including recruitment into IoT botnets; EPSS is at the 99.9th percentile. Added to CISA KEV 2024-08-21. Ransomware association: Unknown.",
@@ -102134,7 +102726,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Dahua PSIRT (advisory 957). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-33044 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-08-21) + Dahua PSIRT advisory 957.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-21; EPSS ~0.999 reflects mass scanning and botnet exploitation of internet-exposed Dahua cameras and OEM-rebranded devices. No confirmed ransomware use.",
@@ -102228,7 +102820,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Jenkins by Yaniv Nizry (SonarSource). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23897 (CWE-22/CWE-27, CVSS 9.8) + CISA KEV (added 2024-08-19, ransomware Known) + Jenkins Security Advisory 2024-01-24 (SECURITY-3314).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2024-08-19 with a Known ransomware association; the near-1.0 EPSS and mass scanning reflect widespread exploitation of internet-exposed Jenkins controllers, where the arbitrary file read is chained to full RCE via leaked secrets/keys.",
@@ -102322,7 +102914,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to SolarWinds by an external researcher and published in the SolarWinds trust-center advisory. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-28986 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-08-15) + SolarWinds security advisory CVE-2024-28986.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-15 on evidence of active exploitation; SolarWinds could only reproduce it authenticated, but it is exploited in the wild against internet-facing Web Help Desk. Ransomware use not flagged in KEV.",
@@ -102412,7 +103004,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft and fixed in the August 2024 Patch Tuesday; researcher-credited disclosure, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38107 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-08-13) + Microsoft Security Update Guide advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-13 as an actively-exploited local privilege escalation; the Windows Power Dependency Coordinator use-after-free lets a local attacker reach SYSTEM and is used as a post-exploitation escalation step. Ransomware use is unconfirmed but SYSTEM-grade LPEs are common in ransomware and hands-on-keyboard intrusions.",
@@ -102594,7 +103186,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by Gen Digital researchers Luigino Camastra and Milanek. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38193 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-08-13) + Microsoft MSRC advisory CVE-2024-38193.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by North Korea's Lazarus Group to escalate to SYSTEM and install the FudModule rootkit, targeting cryptocurrency and aerospace personnel. Discovered in-the-wild by Gen Digital; no ransomware association reported.",
@@ -102689,7 +103281,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Trend Micro's Zero Day Initiative Threat Hunting team while analysing DarkGate/Water Hydra activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38213 (CWE-693, CVSS 6.5) + CISA KEV (added 2024-08-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day since March 2024 by the DarkGate operators (Water Hydra / DarkCasino), who staged payloads on WebDAV shares so copy-paste operations stripped Mark-of-the-Web, evading SmartScreen and Protected View. Added to CISA KEV 2024-08-13; no confirmed ransomware use.",
@@ -102784,7 +103376,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by AhnLab and South Korea's NCSC after in-the-wild detection of APT37 activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38178 (CWE-843, CVSS 7.5) + CISA KEV (added 2024-08-13) + MSRC advisory for CVE-2024-38178.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by North Korea's APT37 (ScarCruft/RedEyes) in June 2024 against South Korean targets via Edge's Internet Explorer (legacy WebView / JScript9) mode, delivering RokRAT through a compromised ad service. A type-confusion bypass of the prior CVE-2022-41128 patch.",
@@ -102874,7 +103466,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Coordinated disclosure via Microsoft MSRC (August 2024 Patch Tuesday). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38189 (CWE-20, CVSS 8.8) + CISA KEV (added 2024-08-13) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-13 as an actively-exploited Microsoft Project remote code execution flaw triggered when a victim opens a malicious Project file. Exploitation depends on the target having disabled the 'Block macros from running in Office files from the Internet' policy and Trust Center notifications.",
@@ -102966,7 +103558,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Apache OFBiz project and fixed via OFBIZ-13006. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-32113 (CWE-22, CVSS 9.8) + CISA KEV (added 2024-08-07) + Apache OFBiz issue OFBIZ-13006.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (EPSS ~0.994, 99.9th percentile) and KEV-listed; the path-traversal flaw in the OFBiz controller is used to reach restricted endpoints and achieve remote code execution. Ransomware use not confirmed.",
@@ -103151,7 +103743,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by Code White (Nicolas Joly / researchers); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2018-0824 (CWE-502, CVSS 8.8) + CISA KEV (added 2024-08-05) + Microsoft MSRC advisory for CVE-2018-0824.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in August 2024 after in-the-wild use; the flaw (UnmarshalPwn) has been leveraged for privilege escalation and code execution, including by Chinese threat actors (e.g. Cinnamon Tempest / activity around the ChamelGang and ransomware operators). CISA KEV ransomware status: Unknown.",
@@ -103254,7 +103846,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Microsoft researchers after observing post-compromise ransomware use; disclosed with Broadcom. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-37085 (CWE-287/CWE-305, CVSS 7.2) + CISA KEV (added 2024-07-30, ransomware Known) + Broadcom advisory VMSA-2024-0013.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Flagged 'Known' for ransomware use in CISA KEV (added 2024-07-30). Microsoft observed Storm-0506, Storm-1175, Octo Tempest and Manatee Tempest abusing it post-compromise to seize domain-joined ESXi hypervisors, leading to Akira and Black Basta ransomware deployments and mass-VM encryption.",
@@ -103450,7 +104042,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Assetnote researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-5217 (CWE-184/CWE-697, CVSS 9.8) + CISA KEV (added 2024-07-29) + ServiceNow KB1648313.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in global reconnaissance campaigns; chained with CVE-2024-4879 (and CVE-2024-5178) by unauthenticated attackers to execute code and dump ServiceNow user/credential data from internet-exposed instances (~42,000 exposed at disclosure). Added to CISA KEV 2024-07-29, EPSS ~99.9th percentile. Ransomware association: Unknown per KEV.",
@@ -103546,7 +104138,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to ServiceNow; public root-cause analysis by Assetnote. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4879 (CWE-1287, CVSS 9.3) + CISA KEV (added 2024-07-29) + ServiceNow advisory KB1645154.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-29; EPSS ~0.9998 reflects mass exploitation of internet-facing Now Platform instances following public analysis. Unauthenticated RCE chained with other ServiceNow flaws for data theft. No confirmed ransomware use.",
@@ -103732,7 +104324,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered via in-the-wild attacks (December 2012 watering-hole campaigns) and analyzed by Microsoft/researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2012-4792 (CWE-416, CVSS 8.8) + CISA KEV (added 2024-07-23) + Microsoft Security Advisory 2794220 / MS13-008.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in December 2012 via watering-hole drive-by pages (notably the Council on Foreign Relations compromise) using a CDwnBindInfo use-after-free; re-added to CISA KEV 2024-07-23. The impacted Internet Explorer is end-of-life and should be disconnected.",
@@ -103823,7 +104415,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to VMware and addressed in VMSA-2022-0009 (April 2022); researcher-credited disclosure, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-22948 (CWE-276, CVSS 6.5) + CISA KEV (added 2024-07-17) + VMware advisory VMSA-2022-0009.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-17; a non-administrative vCenter user can read sensitive files (including credentials/secrets on disk) due to incorrect default file permissions, which is valuable for privilege escalation and lateral movement within virtualization infrastructure. Ransomware use is unconfirmed but vCenter is a prime ransomware pivot.",
@@ -103919,7 +104511,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Hussein Daher (Web Immunify) to SolarWinds and fixed in Serv-U 15.4.2 Hotfix 2. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-28995 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-07-17) + SolarWinds security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "SolarWinds Serv-U directory-traversal enabling unauthenticated read of arbitrary host files. Added to CISA KEV 2024-07-17 amid mass Internet-wide scanning and exploitation (very high EPSS ~0.996) shortly after the Rapid7 write-up and public PoCs appeared. No specific ransomware attribution.",
@@ -104011,7 +104603,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe by researcher 'spacewasp'; CosmicSting exploitation analyzed by Assetnote and Sansec. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-34102 (CWE-611, CVSS 9.8) + CISA KEV (added 2024-07-17) + Adobe advisory APSB24-40.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited as 'CosmicSting' against Adobe Commerce/Magento storefronts; an unauthenticated crafted XML document triggers XXE that, chained with a PHP object-injection/file-read primitive, yields RCE and mass storefront compromise. No user interaction required; widely abused to plant skimmers and webshells.",
@@ -104109,7 +104701,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through the GeoServer/GeoTools security advisory process (GHSA-6jj6-gm7p-fcvv). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-36401 (CWE-94/CWE-95, CVSS 9.8) + CISA KEV (added 2024-07-15) + GeoServer GitHub Security Advisory GHSA-6jj6-gm7p-fcvv.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-15; near-1.0 EPSS reflects mass exploitation of internet-facing GeoServer instances, with botnets and cryptominers dropping payloads via OGC request parameters. Because the flaw affects ALL default installs, exploitation was widespread. Ransomware use not confirmed.",
@@ -104203,7 +104795,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by security researcher Arseniy Sharoglazov (Positive Technologies). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23692 (CWE-94/CWE-1336, CVSS 9.8) + CISA KEV (added 2024-07-09) + GitHub Advisory GHSA-cw5c-xm7f-wx63.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Under broad active exploitation (EPSS ~0.99); unauthenticated attackers use HFS template/macro injection to run OS commands on Internet-exposed file servers, frequently for cryptominer and loader deployment. HFS 2.3m is end-of-life with no vendor patch.",
@@ -104293,7 +104885,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Coordinated disclosure via Microsoft MSRC (July 2024 Patch Tuesday). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38080 (CWE-190, CVSS 7.8) + CISA KEV (added 2024-07-09) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-09 as a zero-day in the July 2024 Patch Tuesday. A local attacker with user-level permissions can escalate to SYSTEM via a Hyper-V flaw, making it a valuable post-compromise privilege-escalation primitive.",
@@ -104386,7 +104978,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by Check Point Research (Haifei Li); campaign analysis by Check Point and Trend Micro (Void Banshee). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38112 (CWE-451, CVSS 7.5) + CISA KEV (added 2024-07-09) + Microsoft MSRC advisory for CVE-2024-38112.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Void Banshee APT to deliver the Atlantida infostealer; malicious internet-shortcut (.url) files with an mhtml handler force disabled Internet Explorer to open attacker HTML/HTA, leading to code execution. KEV-listed 2024-07-09. Ransomware use not confirmed.",
@@ -104478,7 +105070,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Sygnia during a Velvet Ant incident-response investigation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-20399 (CWE-78, CVSS 6.7) + CISA KEV (added 2024-07-02) + Cisco advisory cisco-sa-nxos-cmd-injection-xD9OhyOP.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Sygnia attributed exploitation to the China-nexus espionage group Velvet Ant, who used it as a zero-day to run custom malware on Cisco Nexus switches for persistent, low-visibility access. CISA listed it 2024-07-02; requires stolen Administrator credentials, so it functions as a stealthy escape from the CLI to root. No ransomware.",
@@ -104574,7 +105166,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Roundcube project via coordinated disclosure; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-13965 (CWE-79/CWE-80, CVSS 6.1) + CISA KEV (added 2024-06-26) + Roundcube security updates 1.4.5 and 1.3.12 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in June 2024; Roundcube webmail XSS flaws have been chained by espionage actors (e.g. Winter Vivern / APT28-style campaigns) to steal mail and session data from government and diplomatic targets. CISA KEV ransomware status: Unknown.",
@@ -104673,7 +105265,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Team Orca of Sea Security working with Trend Micro Zero Day Initiative. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-2586 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-06-26) + Red Hat / oss-security advisories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-06-26 as actively exploited. A use-after-free in the Linux kernel nf_tables (nft_object cross-table set reference) lets a local attacker with CAP_NET_ADMIN escalate to root. Ransomware association is unconfirmed.",
@@ -104767,7 +105359,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the JAI-EXT/GeoServer projects and published as GHSA-v92f-jx6p-73rx. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-24816 (CWE-94, CVSS 10.0) + CISA KEV (added 2024-06-26) + GitHub Security Advisory GHSA-v92f-jx6p-73rx.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV after in-the-wild exploitation against GeoServer, which bundles the vulnerable jt-jiffle; on a default install the Jiffle-backed WPS endpoint is reachable unauthenticated, giving unauth RCE. EPSS ~0.99. Ransomware status Unknown.",
@@ -104862,7 +105454,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Progress by Soroush Dalili and Sina Kheirkhah. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4358 (CWE-290, CVSS 9.8) + CISA KEV (added 2024-06-13) + Progress Telerik advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild, typically chained with CVE-2024-1800 (deserialization) to achieve unauthenticated remote code execution on Telerik Report Server; public exploitation followed rapidly after disclosure. Added to CISA KEV 2024-06-13, EPSS ~99.9th percentile. Ransomware association: Unknown.",
@@ -104956,7 +105548,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft; in-the-wild tool analyzed by Symantec Threat Hunter Team. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-26169 (CWE-269, CVSS 7.8) + CISA KEV (added 2024-06-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Ransomware-linked: Symantec attributed an exploit tool for this flaw to the Cardinal/Storm-1811 group behind Black Basta, with build timestamps predating the patch (likely zero-day). Added to CISA KEV 2024-06-13.",
@@ -105046,7 +105638,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and fixed by Google in the June 2024 Pixel/Android Security Bulletin. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-32896 (CWE-670/CWE-783, CVSS 7.8) + CISA KEV (added 2024-06-13) + Android Pixel Security Bulletin 2024-06-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google warned in June 2024 that this Pixel firmware/Android Framework flaw was under limited, targeted exploitation as a zero-day, consistent with forensic/spyware tooling that chains a local privilege escalation to defeat device protections. No ransomware association is recorded.",
@@ -105140,7 +105732,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by DEVCORE (Orange Tsai); patched by the PHP Group. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4577 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-06-12) + PHP Group release notes for 8.1.29/8.2.20/8.3.8.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited in the wild since disclosure (June 2024) against Windows Apache + PHP-CGI, used by multiple actors and ransomware operators for arbitrary code execution and source disclosure; EPSS ~0.9999 and CISA KEV flags ransomware use as Known. This is a Best-Fit code-page bypass of the older CVE-2012-1823 fix.",
@@ -105233,7 +105825,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Arm in its Mali GPU driver security bulletin with acknowledgement of in-the-wild exploitation; researcher/vendor-credited, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4610 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-06-12) + Arm Mali GPU Kernel Driver security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Arm confirmed there are indications this use-after-free is being exploited in the wild; added to CISA KEV 2024-06-12. Because Bifrost/Valhall Mali GPU drivers ship in a very large population of Android devices, a local non-privileged app can leverage it for privilege escalation / sandbox escape. Ransomware flag is Unknown; the class is favored by mobile spyware / targeted implant chains.",
@@ -105325,7 +105917,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Oracle and fixed in the April 2017 Critical Patch Update; the WLS-WSAT research is credited to security researchers (e.g. via Oracle PSIRT). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-3506 (CWE-78, CVSS 7.4) + CISA KEV (added 2024-06-03) + Oracle Critical Patch Update April 2017.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Oracle WebLogic Server Web Services (WLS-WSAT) OS command injection via a crafted SOAP/XML HTTP request. Added to CISA KEV 2024-06-03; the WLS-WSAT vector (shared with CVE-2017-10271) has been abused for years by cryptomining and access-broker actors against internet-facing WebLogic. No specific ransomware attribution.",
@@ -105421,7 +106013,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by researcher Mingi Cho (Theori); public exploit by Notselwyn. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-1086 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-05-30, ransomware Known) + upstream kernel fix commit f342de4e2f33.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA flags known ransomware use: a local attacker exploits the nf_tables use-after-free to gain root on unpatched Linux hosts. A widely-shared public exploit makes it a reliable post-compromise privilege-escalation primitive across many distributions.",
@@ -105615,7 +106207,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Rapid7 during an incident investigation; JAVS pulled the affected installer. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4978 (CWE-506, CVSS 8.7) + CISA KEV (added 2024-05-29) + Rapid7 R7 disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A trojanized JAVS Viewer 8.3.7 installer distributed through the vendor's software supply chain shipped a malicious binary (fffmpeg.exe) that opens a C2 backdoor and runs unauthorized PowerShell. Confirmed in-the-wild supply-chain compromise; affected hosts require full reimage, not just software update.",
@@ -105799,7 +106391,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Apache Flink project and fixed in commit b561010b (released 1.11.3/1.12.0). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-17519 (CWE-552, CVSS 7.5) + CISA KEV (added 2024-05-23) + Apache Flink security advisory (lists.apache.org).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited and mass-scanned (EPSS ~0.978); attackers read arbitrary files (e.g. configuration, credentials, /etc/passwd) from the Flink JobManager host via its REST interface. Frequently used against internet-exposed Flink dashboards. Ransomware use not confirmed.",
@@ -105892,7 +106484,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by Kaspersky (Boris Larin, Vasily Berdnikov, Mert Degirmenci) after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4947 (CWE-843, CVSS 9.6) + CISA KEV (added 2024-05-20) + Google Chrome stable-channel update.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Reported by Kaspersky and confirmed by Google as exploited in the wild; the campaign used a fake blockchain/game website to deliver the V8 exploit. CISA listed it 2024-05-20. Actively exploited as a zero-day; ransomware not involved.",
@@ -105987,7 +106579,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Horizon3.ai (Naveen Sunkavally); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-43208 (CWE-78/CWE-502, CVSS 9.8) + CISA KEV (added 2024-05-20, ransomware Known) + Horizon3.ai research + NextGen Healthcare Mirth Connect 4.4.1.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in May 2024 and flagged ransomware-associated (ransomware: Known); unauthenticated RCE in Mirth Connect has been mass-exploited against healthcare integration servers for initial access and ransomware staging. EPSS 0.83.",
@@ -106079,7 +106671,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google's Chrome security team; Google credited the reporter anonymously and confirmed in-the-wild exploitation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4761 (CWE-787, CVSS 8.8) + CISA KEV (added 2024-05-16) + Google Chrome Releases advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google acknowledged an exploit exists in the wild and shipped an emergency fix (Chrome 124.0.6367.207). An out-of-bounds write in the V8 JavaScript engine is triggered by a crafted HTML page; it affects all Chromium-based browsers (Chrome, Edge, Opera, Brave). Ransomware association is unconfirmed.",
@@ -106172,7 +106764,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed with a PoC against DIR-605 B2 firmware. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-40655 (CWE-863, CVSS 7.5) + CISA KEV (added 2024-05-16) + D-Link security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in 2024 amid active exploitation of legacy D-Link routers; attackers forge an unauthenticated POST to /getcfg.php to read the device username and password. Affected hardware is EoL/EoS with no fix. Ransomware status Unknown.",
@@ -106266,7 +106858,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by an independent researcher (2014). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-100005 (CWE-352, CVSS 8.0) + CISA KEV (added 2024-05-16) + D-Link advisory SAP10018.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited against internet-exposed legacy D-Link DIR-600 routers to hijack administrator sessions and change router configuration (create admin accounts, enable remote management). All affected hardware revisions are end-of-life; CISA directs retirement/replacement rather than patching. Added to CISA KEV 2024-05-16. Ransomware association: Unknown.",
@@ -106359,7 +106951,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft (credited to anonymous / vendor researchers). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-30040 (CWE-20, CVSS 8.8) + CISA KEV (added 2024-05-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild via crafted documents and added to CISA KEV 2024-05-14; the bypass defeats MSHTML/OLE mitigations to load malicious content when a user opens a lure file. No confirmed ransomware attribution.",
@@ -106451,7 +107043,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by researchers at Kaspersky, DBAPPSecurity, Google Threat Analysis Group and others after discovery amid QakBot activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-30051 (CWE-122/CWE-787, CVSS 7.8) + CISA KEV (added 2024-05-14, ransomware Known) + Microsoft MSRC advisory CVE-2024-30051.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A Windows zero-day patched on 2024-05-14 and abused by QakBot operators (observed May-September 2024) to escalate to SYSTEM; CISA lists a Known ransomware association. The high EPSS and multiple public PoCs indicate broad exploitation potential.",
@@ -106544,7 +107136,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by an anonymous researcher; addressed in the Chrome Stable channel update. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4671 (CWE-416, CVSS 9.6) + CISA KEV (added 2024-05-13) + Google Chrome releases blog (Stable channel update, 2024-05-09).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a Chrome zero-day (Google acknowledged an exploit exists) before the 124.0.6367.201 fix; the Visuals use-after-free is used from a renderer-compromised context to attempt a sandbox escape. No ransomware attribution in KEV.",
@@ -106638,7 +107230,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to GitLab via its HackerOne bug-bounty program and fixed in the January 2024 security release; researcher-credited, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-7028 (CWE-640, CVSS 9.8) + CISA KEV (added 2024-05-01) + GitLab security release (issue 436084).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-05-01; a very high-EPSS (top-percentile) unauthenticated account-takeover flaw that lets an attacker send GitLab password-reset emails to an attacker-controlled unverified address. Widely mass-exploited against internet-facing GitLab instances; compromise of a GitLab account/instance is a supply-chain and source-theft risk. Ransomware flag Unknown.",
@@ -106737,7 +107329,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Peter Girnus and Dustin Childs of Trend Micro's Zero Day Initiative, who observed in-the-wild use by Water Hydra. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29988 (CWE-693, CVSS 8.8) + CISA KEV (added 2024-04-30) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft SmartScreen prompt / Mark-of-the-Web bypass exploited in the wild as a zero-day; Trend Micro ZDI attributed use to the Water Hydra actor delivering DarkMe malware to financial traders. It is chained with CVE-2023-38831 (WinRAR) and CVE-2024-21412 to run a malicious file without a SmartScreen warning. Added to CISA KEV 2024-04-30. No ransomware attribution.",
@@ -106831,7 +107423,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by CrushFTP and analyzed by Airbus CERT / Rapid7 / CrowdStrike. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4040 (CWE-1336/CWE-94, CVSS 10.0) + CISA KEV (added 2024-04-24) + CrushFTP update advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing CrushFTP servers: an unauthenticated attacker abuses server-side template injection to escape the VFS sandbox, read arbitrary files, bypass authentication for admin access, and achieve RCE. Reported targeting of US organizations in a coordinated campaign; no confirmed ransomware tie.",
@@ -107112,7 +107704,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by the U.S. National Security Agency (NSA); GooseEgg exploitation analyzed and published by Microsoft Threat Intelligence. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-38028 (no NVD CWE; judged CWE-269, CVSS 7.8) + CISA KEV (added 2024-04-23) + Microsoft Security Blog GooseEgg / Forest Blizzard analysis (2024-04-22).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild by the Russian state actor Forest Blizzard (APT28/STRONTIUM) using a custom post-compromise tool named GooseEgg, as detailed by Microsoft Threat Intelligence in April 2024. The tool modifies a Print Spooler JavaScript constraints file and executes it with SYSTEM permissions to launch further tooling. Added to CISA KEV 2024-04-23.",
@@ -107210,7 +107802,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered during incident response by Volexity (UTA0218) and analyzed by Palo Alto Networks Unit 42. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-3400 (CWE-77/CWE-20, CVSS 10.0) + CISA KEV (added 2024-04-12, ransomware Known) + Palo Alto Networks advisory (security.paloaltonetworks.com/CVE-2024-3400).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day (Operation MidnightEclipse / UTA0218) to drop the UPSTYLE Python backdoor; CISA flags known ransomware use. EPSS ~1.0. Unauthenticated attackers gain root code execution on internet-facing PAN-OS firewalls, making it a top-priority mass-exploited flaw.",
@@ -107306,7 +107898,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by researcher 'netsecfish' (VDB-259284) with the exploit released to the public. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-3273 (CWE-77, CVSS 9.8) + CISA KEV (added 2024-04-11) + D-Link SAP10383.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited in the wild within days of disclosure: GreyNoise and Shadowserver observed Mirai-botnet operators sending exploit requests across ~92,000 internet-exposed D-Link NAS devices. Chained with the CVE-2024-3272 hardcoded backdoor account for unauthenticated RCE on EoL hardware. No ransomware, but commodity botnet takeover.",
@@ -107399,7 +107991,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by researcher 'netsecfish' (VDB-259283); D-Link confirmed the products are end-of-life. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-3272 (CWE-798, CVSS 9.8) + CISA KEV (added 2024-04-11) + D-Link security announcement SAP10383.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited on internet-exposed, end-of-life D-Link NAS devices; combined with CVE-2024-3273 for hardcoded-credential authenticated command injection, it was rapidly incorporated into botnet (e.g. Mirai-variant) campaigns after public disclosure. EPSS 0.98. CISA KEV ransomware status: Unknown.",
@@ -107495,7 +108087,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by the GrapheneOS project; fixed in the April 2024 Pixel update. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29748 (CWE-755/CWE-280, CVSS 7.8) + CISA KEV (added 2024-04-04) + Android Pixel security bulletin 2024-04-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-04-04 as actively exploited. A logic error in Android/Pixel lets a local attacker interrupt a factory reset triggered by a device-admin app, escalating privilege; it was reportedly leveraged by mobile forensic-extraction tooling to defeat device-wipe protections. Ransomware association is unconfirmed.",
@@ -107583,7 +108175,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google (Android/Pixel security) with GrapheneOS analysis of the fastboot memory-reset gap. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29745 (CWE-908, CVSS 5.5) + CISA KEV (added 2024-04-04) + Android Pixel security bulletin 2024-04-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google flagged limited, targeted exploitation; forensic firms reboot Pixel (and other) devices in the After-First-Unlock state into fastboot mode to dump uninitialized memory and recover data protected by the lock screen. Requires physical access. Ransomware status Unknown.",
@@ -107677,7 +108269,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Nguyen Tien Giang (Jang) of STAR Labs at Pwn2Own Vancouver 2023. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-24955 (CWE-94, CVSS 7.2) + CISA KEV (added 2024-03-26) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild and flagged by CISA KEV as associated with ransomware campaigns; commonly chained with CVE-2023-29357 (auth bypass) to reach unauthenticated RCE on SharePoint Server. Originally demonstrated at Pwn2Own Vancouver 2023 by STAR Labs. Added to CISA KEV 2024-03-26. Ransomware association: Known.",
@@ -107772,7 +108364,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by independent researcher (Applied Risk / Gjoko Krstic). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2019-7256 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-03-25) + Nice/Linear eMerge E3 vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-03-25; EPSS ~0.97 reflects long-running mass exploitation by IoT botnets (including Mirai variants) against internet-exposed eMerge E3 access-control panels. Preauth RCE with no user interaction.",
@@ -107865,7 +108457,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by security researcher Jakub Kramarz; addressed in Ivanti advisory SA-2021-12-02. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-44529 (CWE-94, CVSS 9.8) + CISA KEV (added 2024-03-25, ransomware Known) + Ivanti advisory SA-2021-12-02.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2024-03-25 with a Known ransomware association; the near-1.0 EPSS and available Metasploit/exploit-db modules reflect active exploitation of internet-facing Ivanti EPM CSA appliances, giving unauthenticated attackers a code-execution foothold as the 'nobody' user.",
@@ -107958,7 +108550,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Fortinet by Microsoft researchers and published as FG-IR-24-007. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-48788 (CWE-89, CVSS 9.8) + CISA KEV (added 2024-03-25) + Fortinet PSIRT advisory FG-IR-24-007.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing FortiClient EMS; an unauthenticated SQL injection reaches OS command execution as SYSTEM (via MSSQL xp_cmdshell), and CISA KEV flags ransomware use as Known. EPSS ~0.976.",
@@ -108053,7 +108645,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported privately to Balbooa by researcher Phil Taylor; Balbooa shipped the fix (2.4.1) the day after the report. No AI tooling credited in discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56291 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-10) + Balbooa Forms changelog.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day before Balbooa shipped a fix; CISA added it to KEV on 2026-07-10 citing active exploitation against unpatched Balbooa Forms installs on Joomla sites. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108145,7 +108737,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to iCagenda maintainers via coordinated disclosure; the specific researcher is not publicly credited in the vendor changelog. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-48939 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-10) + iCagenda 4.0.8 changelog.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2026-07-10 alongside the Balbooa Forms flaw, citing active exploitation of Joomla sites running vulnerable iCagenda versions. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108238,7 +108830,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported via coordinated disclosure; the specific researcher is not publicly credited in Joomlack's patch notes. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56290 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-07) + Joomlack forum patch announcement.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2026-07-07 (due date 2026-07-10) citing active exploitation; multiple reports describe webshells being planted on connected Joomla sites through the flaw. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108332,7 +108924,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Langflow AI via GitHub Security Advisory coordinated disclosure; the specific researcher is not named in the public advisory. No AI tooling credited with discovery (the in-the-wild attack itself uses an LLM prompt-injection payload as its exploitation technique, which is distinct from AI-assisted vulnerability discovery).",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-55255 (CWE-639, CVSS 8.4) + CISA KEV (added 2026-07-07) + Langflow GHSA-qrpv-q767-xqq2 + Sysdig exploitation analysis.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Sysdig Threat Research observed the first confirmed in-the-wild exploitation on 2026-06-25 from a single operator who enumerated flow IDs and executed victims' Langflow flows to exfiltrate embedded API keys via a prompt-injection payload. CISA added it to KEV on 2026-07-07. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108426,7 +109018,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "First publicly flagged by a JoomShaper forum user (\"[URGENT] Potential Security Vulnerability Identified\") before formal CVE coordination. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-48908 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-07) + JoomShaper forum advisory thread.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Live attacks have been traced in Joomla access logs: an unauthenticated POST to the uploadCustomIcon task, followed by a GET to the planted PHP file, followed by creation of a rogue Super User account. CISA added it to KEV on 2026-07-07. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108520,7 +109112,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe via coordinated disclosure and patched in APSB26-68; the original discovering researcher is not named in the advisory. WatchTowr Labs' subsequent public technical analysis (not the original report) is what enabled rapid in-the-wild reproduction. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-48282 (CWE-22, CVSS 10.0) + CISA KEV (added 2026-07-07) + Adobe Security Bulletin APSB26-68.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEVIntel honeypots recorded the first in-the-wild exploitation attempt within roughly two hours of the WatchTowr technical write-up going public on 2026-07-06, reading C:\\Windows\\win.ini as a canary. CISA added it to KEV on 2026-07-07 (due 2026-07-10); Canadian and Belgian national CERTs also issued alerts. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108614,7 +109206,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Craft CMS (Pixel & Tonic) via coordinated disclosure; the specific researcher is not publicly credited. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-23209 (CWE-94, CVSS 8.0) + CISA KEV (added 2025-02-20) + Craft CMS GHSA-x684-96hh-833x.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2025-02-20, confirming active exploitation, though no public incident report has described the specific attack chain. Exploitation requires the installation's security key to already be compromised, so observed abuse is likely chained after a separate initial-access flaw (e.g. Craft's own knowledge base references the related CVE-2025-32432 asset-transform RCE as a plausible key-leaking precursor). Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108709,7 +109301,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Palo Alto Networks PSIRT; the nginx/Apache path-confusion technique was publicly detailed by independent researchers (SL Cyber). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-0108 (CWE-306, CVSS 9.1) + CISA KEV (added 2025-02-18) + Palo Alto Networks security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Palo Alto confirmed active exploitation within days of disclosure (Feb 2025); GreyNoise/Shadowserver observed mass scanning and exploitation attempts against internet-exposed PAN-OS management interfaces, frequently chained with CVE-2024-9474 (command injection) for full RCE.",
@@ -108804,7 +109396,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through SonicWall PSIRT; the exploit technique was reverse-engineered and publicly detailed by Bishop Fox researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-53704 (CWE-287, CVSS 9.8) + CISA KEV (added 2025-02-18, ransomware use confirmed) + SonicWall PSIRT advisory SNWLID-2025-0003.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild within days of Bishop Fox publishing a public PoC (Feb 10, 2025); CISA KEV flags confirmed ransomware use — responders observed exploitation tied to intrusions that hijacked active SSL VPN sessions for initial access.",
@@ -108897,7 +109489,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed through Horizon3.ai's Attack Research team and confirmed by the SimpleHelp vendor KB advisory. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-57727 (CWE-22, CVSS 7.5) + CISA KEV (added 2025-02-13, ransomware use confirmed) + SimpleHelp KB security advisory + CISA advisory AA25-163A.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited since January 2025 by ransomware affiliates (DragonForce) as an initial-access vector against unpatched SimpleHelp servers, most notably a utility billing software provider per CISA advisory AA25-163A; CISA KEV flags confirmed ransomware use.",
@@ -108988,7 +109580,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Bill Marczak of The Citizen Lab (University of Toronto's Munk School). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-24200 (CWE-863, CVSS 6.1) + CISA KEV (added 2025-02-12) + Apple security advisories (support.apple.com/en-us/122173, 122174, 122345, 122346).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple confirmed the flaw was exploited in 'an extremely sophisticated attack against specific targeted individuals' — consistent with forensic-extraction tooling (GrayKey/Cellebrite-class hardware) used to defeat USB Restricted Mode on a physically seized, locked device. Not mass-exploited; no ransomware association.",
@@ -109083,7 +109675,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Mitel's coordinated disclosure process (Product Security Advisory 24-0019). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-41710 (CWE-88, CVSS 7.2) + CISA KEV (added 2025-02-12) + Mitel Product Security Advisory 24-0019.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA KEV-listed for confirmed active exploitation; the public GitHub PoC documents chaining administrative access to the phone's management interface with the argument-injection flaw in the boot process to achieve command execution. No ransomware association reported.",
@@ -109346,7 +109938,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by VulnCheck security researchers; active in-the-wild exploitation identified and reported by GreyNoise. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40891 (CWE-78, CVSS 8.8) + CISA KEV (added 2025-02-11) + Zyxel security advisory (2025-02-04).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "GreyNoise observed mass scanning and exploitation attempts against exposed Zyxel legacy DSL CPE devices beginning January 2025; Mirai botnet variants incorporated exploitation of this Telnet-based command injection shortly after, using it (alongside CVE-2024-40890) to recruit EOL routers into botnet infrastructure. Ransomware association is not confirmed (KEV flags ransomware use as Unknown).",
@@ -109439,7 +110031,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by VulnCheck security researchers alongside CVE-2024-40891; active in-the-wild exploitation identified and reported by GreyNoise. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40890 (CWE-78, CVSS 8.8) + CISA KEV (added 2025-02-11) + Zyxel security advisory (2025-02-04).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the same active-exploitation campaign as CVE-2024-40891: GreyNoise and Mirai botnet trackers observed mass scanning/exploitation of exposed Zyxel legacy DSL CPE devices via crafted HTTP POST requests against the CGI management program beginning January 2025. Ransomware association is not confirmed (KEV flags ransomware use as Unknown).",
@@ -109539,7 +110131,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified through active-exploitation incident response and reported by Trimble in coordination with CISA. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2025-0994 (CWE-502, CVSS 8.8) + CISA KEV (added 2025-02-07) + Trimble customer advisory (2025-02-05) + CISA ICS advisory ICSA-25-037-04.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited as a zero-day beginning around January 2025 against internet-facing Cityworks/IIS deployments at local-government and utility operators; Trimble-shared IOCs indicate attackers deployed custom Rust-based loaders to stage the VShell and Cobalt Strike post-exploitation frameworks in memory. No ransomware payload confirmed (KEV flags ransomware use as Unknown), but the affected sectors span water/wastewater, energy, and transportation.",
@@ -109632,7 +110224,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified in the wild by Trend Micro's Zero Day Initiative (ZDI) Threat Hunting team (September 2024) and disclosed to 7-Zip author Igor Pavlov as ZDI-CAN-25456. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-0411 (CWE-693, CVSS 7.0) + CISA KEV (added 2025-02-06) + Zero Day Initiative advisory ZDI-25-045.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day since at least September 2024 by Russian cybercrime groups in a SmokeLoader malware campaign (identified by Trend Micro ZDI Threat Hunting) targeting at least nine Ukrainian government and municipal entities via spear-phishing with homoglyph-spoofed double-encapsulated archives. Ransomware is not confirmed for this campaign (KEV flags ransomware use as Unknown); the assessed intent is cyberespionage tied to the Russia-Ukraine conflict.",
@@ -109725,7 +110317,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Check Point Research; patched by Microsoft in the February 2024 Patch Tuesday release. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21413 (CWE-20, CVSS 9.8) + CISA KEV (added 2025-02-06) + Microsoft MSRC advisory (2024-02-13).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in February 2025 confirming in-the-wild exploitation of this critical (CVSS 9.8) Outlook flaw; EPSS scores it at the 99.8th percentile, indicating near-certain continued exploitation attempts. No ransomware association confirmed (KEV flags ransomware use as Unknown), but the bug's ability to bypass Protected View and leak NTLM credentials makes it attractive for both espionage and commodity intrusion.",
@@ -109818,7 +110410,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Check Point Research (CPR-Zero, CPRID-2193); disclosed to and patched by Audinate. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-23748 (CWE-114, CWE-426, CVSS 7.8) + CISA KEV (added 2025-02-06) + Audinate vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in February 2025, confirming observed in-the-wild exploitation; a low-complexity local DLL side-loading technique against the mDNSResponder.exe component bundled with Audinate's Dante Application Library for Windows, used across pro-audio and broadcast production environments. No ransomware association documented (KEV flags ransomware use as Unknown).",
@@ -109911,7 +110503,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and fixed by Sophos (Cyberoam's parent company) via a hotfix issued December 4, 2020. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-29574 (CWE-89, CVSS 9.8) + CISA KEV (added 2025-02-06) + Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqli (2020-12-10).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Listed in CISA KEV confirming active in-the-wild exploitation of unauthenticated SQL injection against the CyberoamOS WebAdmin interface; on some compromised systems this was used to create unrecognized administrative accounts. CISA's record marks ransomware campaign use as Known, and the product is end-of-life/end-of-service per CISA's required action.",
@@ -110041,7 +110633,7 @@
     "rwep_notes": "RWEP 58. cisa_kev +25, active_exploitation +20, blast_radius +23, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2024-53104": {
-    "name": "Linux Kernel Out-of-Bounds Write Vulnerability",
+    "name": "Linux Kernel Out-of-Bounds Write Vulnerability (CVE-2024-53104)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -110287,7 +110879,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The ObjRef-leak-to-RCE technique against .NET Remoting over HTTP was publicly researched and detailed by codewhitesec; Microsoft patched the underlying information-disclosure flaw. No AI tooling credited.",
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29059 (CWE-209, CVSS 7.5) + CISA KEV (added 2025-02-04) + Microsoft Security Response Center advisory (msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since late 2024/early 2025: attackers send crafted HTTP requests to a vulnerable .NET Remoting-over-HTTP endpoint to leak an ObjRef URI, then use that leaked object reference to open a raw remoting channel and achieve deserialization-based remote code execution. EPSS is 0.986 (99.9th percentile); added to CISA KEV Feb 2025.",
@@ -110675,7 +111267,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to SonicWall PSIRT following Microsoft Threat Intelligence Center (MSTIC) notification of active exploitation; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-23006 (CWE-502, CVSS 9.8) + CISA KEV (added 2025-01-24) + SonicWall PSIRT advisory SNWLID-2025-0002.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft Threat Intelligence Center notified SonicWall of possible active exploitation of this pre-auth deserialization flaw as a zero-day before the January 22, 2025 hotfix; CISA added it to KEV two days later flagging known ransomware use. Threat actors later chained it with CVE-2025-40602 to obtain full root-level RCE on SMA1000 appliances.",
@@ -110860,7 +111452,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Aviatrix PSIRT via standard vulnerability disclosure; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-50603 (CWE-78, CVSS 10.0) + CISA KEV (added 2025-01-16) + Aviatrix PSIRT advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild from January 7-10, 2025, with a sharp surge after a public Nuclei detection template was released; threat actors used unauthenticated command injection to deploy XMRig cryptominers and Sliver C2 backdoors for persistence. Not flagged for ransomware by CISA KEV, but Wiz Research notes 65% of organizations running Aviatrix Controller have a lateral-movement path to administrative cloud control-plane permissions.",
@@ -110955,7 +111547,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Microsoft via MSRC; Microsoft's advisory credits standard vulnerability research channels. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-21335 (CWE-416, CVSS 7.8) + CISA KEV (added 2025-01-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One of three Windows Hyper-V NT Kernel Integration VSP memory-corruption elevation-of-privilege flaws (alongside CVE-2025-21333 and CVE-2025-21334) patched in Microsoft's January 2025 Patch Tuesday; Microsoft confirmed exploitation in the wild at time of disclosure. Used as a local privilege-escalation step to reach SYSTEM after initial host or guest access. Not flagged for ransomware.",
@@ -111046,7 +111638,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Microsoft via MSRC; Microsoft's advisory credits standard vulnerability research channels. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-21334 (CWE-416, CVSS 7.8) + CISA KEV (added 2025-01-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One of three Windows Hyper-V NT Kernel Integration VSP memory-corruption elevation-of-privilege flaws (alongside CVE-2025-21333 and CVE-2025-21335) patched in Microsoft's January 2025 Patch Tuesday; Microsoft confirmed exploitation in the wild at time of disclosure. Used as a local privilege-escalation step to reach SYSTEM after initial host or guest access. Not flagged for ransomware.",
@@ -111137,7 +111729,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Microsoft via MSRC; Microsoft's advisory credits standard vulnerability research channels. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-21333 (CWE-122, CVSS 7.8) + CISA KEV (added 2025-01-14) + Microsoft MSRC advisory + Exploit-DB 52436.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One of three Windows Hyper-V NT Kernel Integration VSP memory-corruption elevation-of-privilege flaws (alongside CVE-2025-21334 and CVE-2025-21335) patched in Microsoft's January 2025 Patch Tuesday; Microsoft confirmed exploitation in the wild at time of disclosure. Used as a local privilege-escalation step to reach SYSTEM after initial host or guest access. Not flagged for ransomware.",
@@ -111522,7 +112114,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by watchTowr Labs (Sonny Macdonald) as a zero-day during MiCollab research and subsequently assigned a CVE by Mitel; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-55550 (CWE-22, CVSS 2.7) + CISA KEV (added 2025-01-07) + Mitel MISA-2024-0029.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Chained with CVE-2024-41713 in live exploitation against internet-facing MiCollab servers around the December 2024 disclosure window. CISA KEV flags a ransomware association for this entry.",
@@ -111615,7 +112207,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and publicly disclosed by watchTowr Labs (Sonny Macdonald); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-41713 (CWE-22, CVSS 9.1) + CISA KEV (added 2025-01-07) + Mitel MISA-2024-0029.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild, frequently chained with CVE-2024-55550, against internet-facing MiCollab NuPoint Unified Messaging endpoints shortly after watchTowr's December 2024 disclosure. CISA KEV flags a ransomware association for this entry.",
@@ -112648,7 +113240,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Adobe via APSB24-14. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-20767 (CWE-284, CVSS 7.4) + CISA KEV (added 2024-12-16) + Adobe APSB24-14.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2024-12-16 (due 2025-01-06) citing in-the-wild use against internet-exposed ColdFusion admin panels to read arbitrary files, including credential/config files. Ransomware association is Unknown.",
@@ -112742,7 +113334,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified through active-exploitation telemetry (Huntress, watchTowr Labs) and reported to Cleo. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-50623 (CWE-434, CVSS 9.8) + CISA KEV (added 2024-12-13, ransomware: Known) + Cleo Product Security Advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited from early December 2024 (activity dating to Dec 3, spiking Dec 8) by a Termite-affiliated ransomware actor; at least ten businesses' Cleo servers were confirmed compromised via arbitrary file write leading to RCE. CISA KEV flags ransomware use as Known.",
@@ -112839,7 +113431,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered/reported by CrowdStrike; observed exploited in the wild and confirmed by Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-49138 (CWE-122, CVSS 7.8) + CISA KEV (added 2024-12-10) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day before the December 2024 Patch Tuesday fix; discovered/reported by CrowdStrike. CLFS driver flaws are a recurring precursor used by ransomware affiliates to reach SYSTEM before domain-wide ransomware deployment; this is the fifth actively-exploited CLFS LPE since 2022.",
@@ -112931,7 +113523,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed via a researcher blog post and exploited in the wild by the PSAUX actor within days of disclosure. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-51378 (CWE-78, CVSS 10.0) + CISA KEV (added 2024-12-04, ransomware: Known) + CyberPanel patch commit 1c0c6cb.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited within days of disclosure by the PSAUX ransomware campaign in October 2024, compromising roughly 22,000 internet-facing CyberPanel instances by chaining the HTTP-verb auth bypass with shell metacharacter injection.",
@@ -113026,7 +113618,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Synacktiv researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-11680 (CWE-306, CVSS 9.8) + CISA KEV (added 2024-12-03) + Synacktiv technical advisory + ProjectSend patch commit 193367d.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since mid-2024; VulnCheck and honeypot telemetry observed mass scanning and exploitation of internet-facing ProjectSend instances to plant webshells and stored XSS payloads ahead of CISA's KEV addition.",
@@ -113119,7 +113711,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and disclosed by Zyxel via vendor advisory; exploited by Helldown ransomware affiliates. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-11667 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-12-03, ransomware: Known) + Zyxel security advisory (2024-11-27).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Used as an initial-access vector by the Helldown ransomware group from around November-December 2024 to compromise internet-exposed Zyxel firewall/VPN management interfaces before deploying ransomware into victim networks. CISA KEV flags ransomware use as Known.",
@@ -113211,7 +113803,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Japan's JVN coordinated-disclosure process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-45727 (CWE-611, CVSS 7.5) + CISA KEV (added 2024-12-03) + JVN#95981460 + North Grid vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2024-12-03 citing confirmed in-the-wild exploitation; Japan's coordinated-disclosure process (JVN) and the vendor confirm real-world attacks reading account information via crafted XML requests. Ransomware association is Unknown.",
@@ -113308,7 +113900,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Array Networks in March 2023; later confirmed under active exploitation by the China-linked group Earth Kasha per CISA/SecurityWeek reporting. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-28461 (CWE-287/CWE-306, CVSS 9.8) + CISA KEV (added 2024-11-25) + Array Networks vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild by the China-linked espionage group Earth Kasha for initial access into target networks; CISA KEV flags this entry with a known history of ransomware-actor use.",
@@ -113677,7 +114269,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Broadcom/VMware; active in-the-wild exploitation attributed to UNC5221 by Mandiant. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38813 (CWE-250/CWE-273, CVSS 7.5) + CISA KEV (added 2024-11-20) + Broadcom VMSA-2024-0019 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild, attributed by Mandiant to the China-linked threat actor UNC5221 targeting critical infrastructure; frequently chained with CVE-2024-38812 to convert initial remote code execution into full root-level control of vCenter Server.",
@@ -113771,7 +114363,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Broadcom/VMware; active in-the-wild exploitation attributed to UNC5221 by Mandiant, following rapid public PoC release. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38812 (CWE-122/CWE-787, CVSS 9.8) + CISA KEV (added 2024-11-20) + Broadcom VMSA-2024-0019 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; attributed by Mandiant to the China-linked threat actor UNC5221 targeting critical infrastructure. Public PoC code emerged on GitHub within 48 hours of Broadcom's advisory, and confirmed real-world exploitation followed within days.",
@@ -113866,7 +114458,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Palo Alto Networks; Unit 42 confirmed in-the-wild mass exploitation chained with CVE-2024-0012. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9474 (CWE-78, CVSS 7.2) + CISA KEV (added 2024-11-18) + Palo Alto Networks security advisory + Unit 42 research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild, chained with CVE-2024-0012 (PAN-OS management-interface authentication bypass) for unauthenticated root-level command execution on internet-exposed firewalls; CISA KEV flags known ransomware-actor use, and Palo Alto Networks/Unit 42 confirmed mass exploitation against devices with an internet-facing management interface.",
@@ -113963,7 +114555,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Rhino Security Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-1212 (CWE-78, CVSS 10.0) + CISA KEV (added 2024-11-18) + Progress/Kemp vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since at least April 2024 via the unauthenticated LoadMaster management web interface; CISA added it to KEV on 2024-11-18. Post-exploitation attackers escalate from the default 'bal' admin account to root by abusing sudo entries.",
@@ -114160,7 +114752,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Zach Hanley of Horizon3.ai. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9465 (CWE-89, CVSS 9.1) + CISA KEV (added 2024-11-14) + Palo Alto Networks PAN-SA-2024-0010.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; Palo Alto Networks confirmed evidence of active exploitation alongside CVE-2024-9463, prompting CISA KEV addition on 2024-11-14.",
@@ -114254,7 +114846,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by the Horizon3.ai research team as part of the Expedition vulnerability chain. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9463 (CWE-78, CVSS 7.5) + CISA KEV (added 2024-11-14) + Palo Alto Networks PAN-SA-2024-0010.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; CISA confirmed evidence of exploitation and added the flaw to KEV on 2024-11-14 alongside CVE-2024-9465. Public exploit code exists for the broader Expedition vulnerability chain.",
@@ -114348,7 +114940,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported via ESET's tracking of the RomCom campaign; patched by Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-49039 (CWE-287, CVSS 8.8) + CISA KEV (added 2024-11-12) + Microsoft MSRC advisory + ESET RomCom research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day by the Russia-aligned RomCom threat actor, chained with a Mozilla Firefox zero-day (CVE-2024-9680) to escape the browser sandbox and escalate to Medium integrity with no user interaction, in campaigns against European and North American targets between October and November 2024.",
@@ -114442,7 +115034,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported via CERT-UA and ClearSky Cyber Security tracking of the UAC-0194 campaign. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43451 (CWE-73, CVSS 6.5) + CISA KEV (added 2024-11-12) + Microsoft MSRC advisory + CERT-UA/ClearSky reporting.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Russia-aligned threat actor UAC-0194 (tracked by CERT-UA and ClearSky) in phishing campaigns against Ukrainian government entities beginning mid-2024, using malicious .url files that trigger an NTLMv2 hash leak via SMB on minimal user interaction to deploy SparkRAT.",
@@ -114537,7 +115129,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Metabase via coordinated disclosure and fixed by the Metabase development team. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-41277 (CWE-22/CWE-200, CVSS 10.0) + CISA KEV (added 2024-11-12) + Metabase security advisory GHSA-w73v-6p7p-fpfr.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; added to CISA KEV on 2024-11-12, roughly three years after disclosure, reflecting sustained real-world targeting of internet-exposed Metabase instances to harvest cloud credentials from environment variables.",
@@ -114632,7 +115224,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Atlassian through their standard vulnerability disclosure process and fixed in Jira Server/DC 8.5.14/8.13.6/8.16.1. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-26086 (CWE-22, CVSS 5.3) + CISA KEV (added 2024-11-12) + Atlassian JRASERVER-72695.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV in November 2024 citing active exploitation of unauthenticated file-read against internet-facing Jira Server/Data Center instances, used to harvest servlet-mapping and configuration detail from web.xml ahead of follow-on attacks. Not flagged as ransomware-associated.",
@@ -114721,7 +115313,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Originally reported to Cisco PSIRT in 2014 (Bug ID CSCun19025); renewed 2024 exploitation surfaced through Cisco PSIRT's own monitoring and third-party reporting (CloudSEK), not AI-attributed.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-2120 (CWE-79, CVSS 6.1) + CISA KEV (added 2024-11-12) + Cisco Security Advisory cisco-sa-CVE-2014-2120.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV in November 2024 after Cisco PSIRT revised its decade-old advisory (originally published 2024-03-18) to note renewed exploitation attempts, with a further bulletin revision on 2024-12-02 confirming additional attempted exploitation. CloudSEK reports the AndroxGh0st botnet operators chaining this WebVPN login-page XSS with other Cisco ASA/IOS flaws in attempts to upload and backdoor PHP files for persistence. Not flagged as ransomware.",
@@ -114905,7 +115497,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Vulnerability documented by independent researcher analysis (dreyand.rs write-up) and patched by the CyberPanel maintainer (commit 5b08cd6); PSAUX ransomware operators separately discovered and mass-weaponized it. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-51567 (CWE-306, CVSS 10.0) + CISA KEV (added 2024-11-07, ransomware: Known) + CyberPanel fix commit 5b08cd6.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since October 2024 by the PSAUX ransomware operation, which used an automated script (ak47.py) to compromise over 22,000 internet-facing CyberPanel instances, deploy a custom encryptor (actually.sh), and drop ransom notes system-wide. CISA flags this KEV entry as ransomware-associated (ransomware: Known).",
@@ -114994,7 +115586,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed through Google/AOSP's internal security review process (Android Security Bulletin); in-the-wild use was surfaced by mobile-security researchers tracking targeted spyware campaigns, not AI tooling.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43093 (CWE-176, CVSS 7.3) + CISA KEV (added 2024-11-07) + Android Security Bulletin 2025-03-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in targeted mobile spyware / cyber-espionage campaigns against activists, journalists, and dissidents; researchers have also linked exploitation attempts to the TOXIC PANDA Android banking-trojan operation. CISA added it to KEV in November 2024; not flagged as ransomware.",
@@ -115089,7 +115681,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by independent security researchers in 2019 with coordinated PacketStorm/Exploit-DB write-ups; developer Marcus Glocker confirmed a fix. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2019-16278 (CWE-22, CVSS 9.8) + CISA KEV (added 2024-11-07) + Nostromo changelog (nazgul.ch/dev/nostromo_cl.txt).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV in November 2024 citing ongoing internet-wide scanning and exploitation of exposed Nostromo nhttpd servers for remote code execution; the flaw has historically been weaponized in Linux/IoT botnet scanning campaigns since 2019. Not flagged as ransomware.",
@@ -115285,7 +115877,7 @@
     },
     "ai_discovered": true,
     "ai_discovery_notes": "GreyNoise's proprietary internal LLM tool 'Sift' flagged anomalous honeypot traffic that didn't match known signatures; GreyNoise Labs researchers investigated the flagged traffic and identified CVE-2024-8956 (paired with the related CVE-2024-8957). Confirmed via GreyNoise's own announcement and independent press coverage (SecurityWeek, BleepingComputer).",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "discovery_attribution_note": "Curated from NVD CVE-2024-8956 (CWE-306/CWE-287, CVSS 9.1) + CISA KEV (added 2024-11-04) + GreyNoise Labs advisory. AI-assisted discovery: GreyNoise Labs surfaced the flaw with its internal Sift LLM anomaly-detection tool from honeypot telemetry.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "GreyNoise observed active scanning and exploitation attempts against the vulnerable /cgi-bin/param.cgi endpoint on live-streaming PTZ cameras shortly after disclosure; not flagged as ransomware-associated by CISA.",
@@ -115376,7 +115968,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Roundcube project via responsible disclosure and fixed in 1.5.7/1.6.7. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-37383 (CWE-79, CVSS 6.1) + CISA KEV (added 2024-10-24) + Roundcube GitHub security patch/release notes.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in June 2024 phishing campaigns (reported by Positive Technologies) targeting government organizations in the CIS region, using SVG-embedded payloads in email attachments to inject fake login forms and steal credentials.",
@@ -115661,7 +116253,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Microsoft in the July 2024 Patch Tuesday release; no AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38094 (CWE-502, CVSS 7.2) + CISA KEV (added 2024-10-22, ransomware=Known) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild using a publicly disclosed proof-of-concept to plant a webshell on a compromised SharePoint server; CISA KEV flags this entry as ransomware-associated (Known).",
@@ -115750,7 +116342,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified jointly by Rackspace and ScienceLogic while investigating a customer-reported monitoring-portal disruption. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9537 (CWE unassigned, CVSS 9.8) + CISA KEV (added 2024-10-21) + ScienceLogic community advisory + Rackspace incident disclosure. CWE assigned editorially: NVD published no CWE for this entry.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day against Rackspace's MyRack monitoring portal (a hosted ScienceLogic SL1 deployment), disrupting monitoring-graph availability and exposing customer account names, usernames, device details, and encrypted internal credentials. Not flagged as ransomware-associated by CISA.",
@@ -115851,7 +116443,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and responsibly disclosed to Veeam by watchTowr Labs researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40711 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-10-17, ransomware=Known) + Veeam KB4649 + watchTowr Labs advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited at scale by Akira and Fog ransomware affiliates within days of watchTowr Labs' public technical write-up, typically chained with compromised VPN credentials to gain initial network access before exploiting the Veeam RCE for domain/backup-infrastructure compromise.",
@@ -115954,7 +116546,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by ESET researchers (as part of RomCom campaign tracking) to Mozilla on 2024-10-08. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9680 (CWE-416, CVSS 9.8) + CISA KEV (added 2024-10-15) + Mozilla Security Advisory MFSA2024-51.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Discovered in the wild by ESET on 2024-10-08 as the trigger for a RomCom (Storm-0978/Tropical Scorpius/UNC2596) zero-click drive-by campaign that chained this Firefox content-process UAF with Windows privilege-escalation flaw CVE-2024-49039 to escape the sandbox and drop the RomCom backdoor with no user interaction. CISA KEV flags this entry as tied to known ransomware-affiliated activity.",
@@ -116054,7 +116646,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Microsoft's standard vulnerability-disclosure process; observed exploitation attributed to APT34 (OilRig). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-30088 (CWE-367, CVSS 7.0) + CISA KEV (added 2024-10-15) + Microsoft MSRC vulnerability guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Patched by Microsoft in June 2024; CISA added it to KEV on 2024-10-15 after confirming active exploitation, later attributed to the Iranian-aligned APT34 (OilRig) for post-compromise privilege escalation. KEV also flags this entry as tied to known ransomware-affiliated activity.",
@@ -116145,7 +116737,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Horizon3.ai researchers during unrelated research into the CVE-2024-28986 WHD deserialization RCE. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-28987 (CWE-798, CVSS 9.1) + CISA KEV (added 2024-10-15) + SolarWinds Trust Center advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA confirmed active exploitation and added this to KEV on 2024-10-15, roughly a month after Horizon3.ai published a working PoC; approximately 827 internet-exposed WHD instances were identified as reachable at disclosure time.",
@@ -116521,7 +117113,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed through Microsoft's standard security-update process for October 2024 Patch Tuesday, consistent with the MSHTML-spoofing technique family tracked in Void Banshee campaigns. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43573 (CWE-79, CVSS 6.5) + CISA KEV (added 2024-10-08) + Microsoft MSRC vulnerability guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Patched and flagged as actively exploited in Microsoft's October 2024 Patch Tuesday, added to CISA KEV on 2024-10-08. This flaw follows the same MSHTML-spoofing pattern as CVE-2024-38112 and CVE-2024-43461, which the Void Banshee APT abused to trick victims into rendering malicious content via the deprecated MSHTML/Internet Explorer engine to deliver the Atlantida infostealer.",
@@ -116614,7 +117206,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Elastic Security Labs threat researchers; no AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43572 (CWE-707, CVSS 7.8) + CISA KEV (added 2024-10-08) + Microsoft MSRC advisory + Elastic Security Labs 'GrimResource' research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild since at least June 2024 as the 'GrimResource' technique (Elastic Security Labs), used for initial access via malicious .msc files that gain full code execution in mmc.exe; observed delivering commodity stealer payloads (e.g. PureLogs Stealer). Not flagged as ransomware-linked by CISA.",
@@ -116704,7 +117296,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Seth Jenkins (Google Project Zero) and Conghui Wang (Amnesty International Security Lab), in coordination with Google Threat Analysis Group; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43047 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-10-08) + Qualcomm October 2024 security bulletin + Google Project Zero / Amnesty International Security Lab reporting.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as part of a targeted spyware chain: Serbian authorities used Cellebrite forensic-extraction tooling to unlock seized Android devices, then chained this Qualcomm DSP use-after-free for privilege escalation to install the 'NoviSpy' spyware against journalists and activists (Amnesty International Security Lab, Dec 2024). Not flagged as ransomware.",
@@ -116796,7 +117388,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Vulnerability researched and technical PoC published by the ProjectDiscovery research team; mass-exploitation tracked by Proofpoint. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-45519 (CWE-78, CVSS 10.0) + CISA KEV (added 2024-10-03) + Zimbra release notes (8.8.15p46 / 9.0.0p41 / 10.0.9 / 10.1.1) + ProjectDiscovery research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited beginning 2024-09-28, days after ProjectDiscovery published technical details and PoC code; attackers sent spoofed emails with base64-encoded shell commands in the CC field to drop webshells on internet-facing Zimbra servers. Not flagged as ransomware by CISA, but used for broad opportunistic RCE.",
@@ -116893,7 +117485,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Originally reported to Ivanti by an anonymous researcher via Trend Micro's Zero Day Initiative; public technical analysis and PoC by Horizon3.ai. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29824 (CWE-89, CVSS 8.8) + CISA KEV (added 2024-10-02) + Ivanti May 2024 security advisory + Horizon3.ai research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild shortly after Horizon3.ai published a deep-dive analysis and working PoC in June 2024; CISA added it to KEV in October 2024 confirming observed exploitation against network-reachable Ivanti EPM Core servers. Not flagged as ransomware by CISA, though EPM compromise is a common precursor to broader intrusions.",
@@ -116983,7 +117575,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by an independent researcher via a GitHub proof-of-concept; no vendor advisory was issued because the product is end-of-life. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-25280 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-09-30, EoL/EoS product) + public GitHub PoC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against end-of-life D-Link DIR-820 routers; CISA added it to KEV noting the product is EoL/EoS with no vendor patch forthcoming, and the required action is to discontinue use rather than remediate. Not flagged as ransomware.",
@@ -117075,7 +117667,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by the CLP-team researcher group with a GitHub PoC; DrayTek issued a fix in firmware 1.5.1. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-15415 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-09-30) + DrayTek security advisory + public GitHub PoC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing DrayTek Vigor3900/2960/300B management interfaces; added to CISA KEV in September 2024 despite the flaw and vendor fix dating to 2020, indicating a long tail of unpatched exposed devices continuing to be targeted (DrayTek routers have separately been implicated in botnet and state-linked campaigns). Not flagged as ransomware.",
@@ -117170,7 +117762,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by SAP's Product Security Response Team in 2019; public exploitation technique documented by independent Java-deserialization researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2019-0344 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-09-30) + SAP Security Note 2786035 + GitHub Advisory GHSA-75jg-chc9-wv8p.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "An aged (2019) flaw added to CISA KEV in September 2024, indicating renewed/ongoing active exploitation against internet-facing SAP Commerce Cloud (Hybris) instances that were never patched — likely opportunistic scanning against long-lived unpatched deployments rather than a fresh campaign. Not flagged as ransomware.",
@@ -117270,7 +117862,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported and fixed through Ivanti's own PSIRT/security-disclosure process. No AI tooling credited in the advisory or subsequent research write-ups.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7593 (CWE-287/CWE-303, CVSS 9.8) + CISA KEV (added 2024-09-24) + Ivanti Security Advisory (forums.ivanti.com).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA KEV added 2024-09-24 (due 2024-10-15) after mass scanning and exploitation of internet-exposed vTM admin panels to plant rogue administrator accounts within days of public disclosure. Ransomware use is unknown/unconfirmed.",
@@ -117526,7 +118118,7 @@
     "poc_available": false,
     "poc_description": "Horizon3.ai published a technical root-cause writeup and added a NodeZero detection test, but released no public standalone PoC/exploit. Exploitation observed is in-the-wild only; no Metasploit/ExploitDB/GitHub weaponized reproducer confirmed.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and responsibly disclosed by Horizon3.ai (researcher Zach Hanley); found 2026-05-21, reported 2026-05-22, published 2026-06-12. Some secondary press stated the finding was aided by generative AI, but the primary Horizon3 advisory names no specific AI system.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -117633,7 +118225,7 @@
     "poc_available": true,
     "poc_description": "Multiple public GitHub PoCs exist, e.g. github.com/sandsoncosta/CVE-2025-26633 (arbitrary command execution via a malicious .msc/MMC snap-in) and github.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation (creates a local admin via a crafted MSC file on unpatched Windows). Both marked authorized-testing-only.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Detected in-the-wild and reported through Trend Micro / Trend Zero Day Initiative (ZDI) in cooperation with Microsoft; patched on the March 11, 2025 Patch Tuesday. No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -117748,7 +118340,7 @@
     "poc_available": true,
     "poc_description": "Horizon3.ai published full technical details plus a working proof-of-concept exploit on 2025-02-19 covering all four EPM CVEs, demonstrating the crafted-UNC-path credential coercion.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -117862,7 +118454,7 @@
     "poc_available": true,
     "poc_description": "Covered by the same Horizon3.ai research and proof-of-concept exploit published 2025-02-19 for the four Ivanti EPM CVEs.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -117976,7 +118568,7 @@
     "poc_available": true,
     "poc_description": "Included in Horizon3.ai's 2025-02-19 technical writeup and public proof-of-concept exploit spanning all four EPM CVEs.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118090,7 +118682,7 @@
     "poc_available": false,
     "poc_description": "No public standalone weaponized PoC/Metasploit/ExploitDB module identified; the flaw is trivially reproducible (authenticated file upload) and was documented via in-the-wild webshell activity by Intezer/Solis, which are incident writeups rather than a published exploit.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Detected in-the-wild and reported by Intezer researchers (Nicole Fishbein, Joakim Kennedy, Justin Lentz) with Solis Security. No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118195,7 +118787,7 @@
     "poc_available": true,
     "poc_description": "The exact injectable endpoint and parameter (GET timeoutWarning.asp, PmSess1) are published in the Intezer and Solis Security writeups, making it directly sqlmap-exploitable; CVE aggregators list 2-3 public GitHub PoCs and a Tenable WAS detection plugin (114935) exists. Treat as publicly reproducible.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered in-the-wild by Intezer and Solis Security researchers while investigating XE Group intrusions; reported early Feb 2025. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118307,7 +118899,7 @@
     "poc_available": false,
     "poc_description": "In-the-wild exploitation was via Cellebrite's proprietary, non-public forensic chain. No public standalone weaponized PoC has been released; the kernel fix commit and Amnesty research brief describe the flaw and chain but provide no working reproducer.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "In-the-wild use discovered and attributed by Amnesty International Security Lab (with Google's Threat Analysis Group). The kernel fix landed Nov 2024 and the CVE was announced by Greg Kroah-Hartman (2024-11-19). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118412,7 +119004,7 @@
     "poc_available": true,
     "poc_description": "Full working exploit published on GitHub by Sina Kheirkhah (@SinSinology, Summoning Team) at github.com/sinsinology/CVE-2024-4885 on Aug 30, 2024, with a technical writeup at summoning.team. Also mirrored on Sploitus.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by Sina Kheirkhah of Summoning Team with Trend Micro Zero Day Initiative (ZDI); reported to Progress Apr 24, 2024. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118521,7 +119113,7 @@
     "poc_available": true,
     "poc_description": "Public PoC/exploit code is available on GitHub, catalogued in the SecWiki/windows-kernel-exploits collection and other kernel-exploit aggregators. A compiled local-privilege-escalation exploit binary circulates for this CVE.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Not clearly credited in retrieved primary sources; the MSRC advisory does not publicly name a finder. Unconfirmed. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118631,7 +119223,7 @@
     "poc_available": true,
     "poc_description": "Weaponized Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti (Rapid7, May 2023) chains both CVEs to a shell; standalone exploit also on Packet Storm (172296).",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118743,7 +119335,7 @@
     "poc_available": true,
     "poc_description": "Covered by the same weaponized Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti (Rapid7) and the Packet Storm exploit (172296), which use this bug to bypass auth before triggering the injection.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118851,7 +119443,7 @@
     "poc_available": true,
     "poc_description": "CVE aggregators list ~3 public GitHub PoCs for the command-injection primitive; the flaw requires valid administrative credentials (PR:H) but the injection technique is public. No single vendor/Metasploit module confirmed.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported to Cisco by Wang Jincheng of the X1cT34m Laboratory, Nanjing University of Posts and Telecommunications. In-the-wild exploitation attributed to PolarEdge botnet operators (Sekoia). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118963,7 +119555,7 @@
     "poc_available": false,
     "poc_description": "No public standalone weaponized PoC located. Exploitation was in-the-wild-only (Google TAG); no ExploitDB/Metasploit/GitHub reproducer specific to CVE-2023-34192 was found.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Clement Lecigne, Google Threat Analysis Group (reported to Zimbra as an actively-exploited zero-day). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119067,7 +119659,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC. It is a cloud/SaaS service flaw fixed server-side by Microsoft; exploitation details are private and no ExploitDB/Metasploit/GitHub reproducer exists.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Exploitation detected by Microsoft; the specific reporting researcher is not named in publicly accessible sources. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119171,7 +119763,7 @@
     "poc_available": false,
     "poc_description": "No public weaponized PoC found. ZDI-24-096 documents the ExportServlet deserialization root cause but ships no exploit; no ExploitDB/Metasploit/GitHub reproducer specific to CVE-2024-20953 was located.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Trend Micro Zero Day Initiative (ZDI-24-096); ZDI credits the researcher alias 'nexteam'. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119275,7 +119867,7 @@
     "poc_available": true,
     "poc_description": "Multiple public weaponized PoCs: ExploitDB #43993 (BlazeDS Java Object Deserialization RCE), the depthsecurity/coldfusion_blazeds_des GitHub exploit, the 'ColdFusionPwn' AMF payload generator (ysoserial-based), and a vulhub reproducible lab.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported to Adobe by Markus Wulftange of Code White GmbH. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119741,8 +120333,8 @@
     "poc_available": true,
     "poc_description": "Live payload. trap-core.js (48,485 bytes / 1,149 lines) shipped across the campaign (19 npm packages per The Hacker News; the GHSA-7r6r-hqg7-f6mq anchor cluster covers 10 npm packages by maintainer ddjidd5640, published 2026-05-19..21); PyPI variants auto-execute on import via `node -e` pulling JS from ddjidd564.github.io; crates.io variants run via build.rs at compile time, XOR-encrypting keystores with hardcoded key 'cargo-build-helper-2026' and exfiltrating to GitHub Gists. The malicious build IS the PoC. [Socket, 2026-05; OSV MAL-2026-4207, 2026-05-26]",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "Discovered by Socket behavioral/cross-registry detection (median 5m27s, fastest 58s after publication). No AI tool credited for discovery. ai_discovery_source=vendor_research (enum lacks 'ecosystem_detection'). [Socket, 2026-05]",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovered by Socket behavioral/cross-registry detection (median 5m27s, fastest 58s after publication). No AI tool credited for discovery. [Socket, 2026-05]",
     "ai_assisted_weaponization": true,
     "ai_assisted_notes": "Novel AI-attack vector: the payload plants .cursorrules and CLAUDE.md files containing instructions hidden with zero-width Unicode characters, designed to trick AI coding assistants (Cursor, Claude Code) into running a fake 'security scan' that discovers and exfiltrates local secrets. This is AI-assistant prompt-injection as a weaponization channel, distinct from AI-generated payload code. [Socket, 2026-05; The Hacker News, 2026-05] — maps ATLAS AML.T0051 (LLM prompt injection).",
     "active_exploitation": "confirmed",
@@ -119909,8 +120501,8 @@
     "poc_available": true,
     "poc_description": "Live payload — ~164 (escalated to ~179) malicious scoped packages were published to the public npm registry across two waves (2026-05-27 21:15–21:37 UTC; 2026-05-29 09:01–09:02 UTC) by attacker-controlled accounts mr.4nd3r50n / pik-libs / t-in-one (ce-rwb in the Microsoft cluster). The installable malicious build + obfuscated scripts/postinstall.js stager IS the PoC. Source: OSV MAL-2026-4978; SafeDep 2026-05-29; Microsoft Security 2026-05-29.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem detection by SafeDep (campaign analysis OSV cites) and Microsoft Security; OSV/GitHub Advisory Database assigned MAL-*/GHSA ids. ai_discovery_source set to `vendor_research` because the enum lacks an `ecosystem_detection` value; this note records the actual provenance.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem detection by SafeDep (campaign analysis OSV cites) and Microsoft Security; OSV/GitHub Advisory Database assigned MAL-*/GHSA ids.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-tooling credit on the payload-development side. The 7–13 KB obfuscated postinstall stager follows a conventional string-encoding/minifier pattern; no AI-generated-code fingerprint reported by the responding firms. UNVERIFIED whether any tooling was AI-assisted — no source asserts either way.",
     "active_exploitation": "confirmed",
@@ -120097,7 +120689,7 @@
     "poc_available": true,
     "poc_description": "Stack-based buffer overflow in the Ivanti Connect Secure web/IF-T component reachable by an unauthenticated remote attacker. Mandiant and Ivanti disclosed active zero-day exploitation on 2025-01-08; public technical write-ups and detection content (watchTowr, Rapid7, Mandiant) followed within days. Exploitation deploys the SPAWN malware ecosystem (SPAWNANT installer, SPAWNMOLE tunneler, SPAWNSNAIL SSH backdoor), the PHASEJAM dropper, and the DRYHOOK credential stealer.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by Ivanti/Mandiant during active-incident investigation; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Zero-day exploited from at least mid-December 2024 by the suspected China-nexus cluster UNC5337 (assessed within UNC5221) before the 2025-01-08 advisory. CISA KEV-listed same day; later flagged for known ransomware-campaign use. Ivanti's Integrity Checker Tool (ICT) is the primary on-box detection. CISA directed agencies to apply the patch and, where compromise indicators are present, factory-reset and rebuild rather than patch-in-place.",
@@ -120208,7 +120800,7 @@
     "poc_available": true,
     "poc_description": "Stack-based buffer overflow in Connect Secure reachable unauthenticated. Mandiant/Ivanti reported active exploitation beginning mid-March 2025 by UNC5221, using the TRAILBLAZE in-memory dropper and the BRUSHFIRE passive backdoor alongside the SPAWN ecosystem. The bug was patched in 22.7R2.6 before it was understood to be RCE-capable, so unpatched fleets were exploited after the fix shipped.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Vendor/Mandiant incident-driven; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Confirmed in-the-wild RCE exploitation from mid-March 2025 by UNC5221; CISA KEV-listed 2025-04-04, later ransomware-flagged. Demonstrates the 'mis-triaged severity' failure mode — a flaw patched as low-risk DoS was weaponized to RCE, so SLA prioritization keyed on the initial CVSS under-protected fleets.",
@@ -120318,7 +120910,7 @@
     "poc_available": true,
     "poc_description": "The Visual Composer Metadata Uploader endpoint (/developmentserver/metadatauploader) lacks an authorization check, letting an unauthenticated attacker upload an executable (JSP webshell) that runs with SAP service privileges. Mass exploitation observed from April 2025; ReliaQuest first reported in-wild use, with JSP webshells (helper.jsp, cache.jsp, randomly-named) dropped under the servlet path and later follow-on by ransomware affiliates.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Identified during active-incident investigation (ReliaQuest) and confirmed by SAP; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Confirmed mass in-the-wild exploitation from April 2025; CISA KEV-listed 2025-04-29 and ransomware-flagged. Frequently chained with the SAP NetWeaver deserialization flaw CVE-2025-42999. Webshell access enabled hands-on-keyboard follow-on including ransomware staging.",
@@ -120427,7 +121019,7 @@
     "poc_available": true,
     "poc_description": "An authentication-bypass in the HTTP authorization-header handling lets an unauthenticated attacker authenticate as any known/guessable account, including crushadmin, taking over the instance (unless a DMZ proxy instance fronts it). Exploited in the wild in March-April 2025; technical details and detection content published by Outpost24, VulnCheck, and Rapid7.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported to CrushFTP by Outpost24; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Confirmed in-the-wild exploitation March-April 2025; CISA KEV-listed 2025-04-07 with known ransomware-campaign use. crushadmin takeover yields full file-server control and downstream data access; observed follow-on tooling includes remote-management agents.",
@@ -121251,7 +121843,8 @@
     "last_updated": "2026-05-13",
     "discovery_attribution_note": "AI-surfaced by Theori using Xint Code AI scanner with one operator prompt against the Linux crypto/ subsystem; researcher Taeyang Lee directed the scan. Disclosed 2026-04-29. Source: Theori writeup mirrored at https://xint.io/blog/copy-fail-linux-distributions and Sysdig coverage https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds.",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": false
+    "known_ransomware_use": false,
+    "ai_discovery_source": "bug_bounty_ai_augmented"
   },
   "CVE-2026-39884": {
     "name": "Flux159 mcp-server-kubernetes Argument Injection via port_forward",
@@ -121795,8 +122388,8 @@
     "poc_available": true,
     "poc_description": "Confirmed in-the-wild — 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. The worm itself IS the PoC; payload analysis published by multiple researchers within 20 minutes.",
     "ai_discovered": false,
-    "ai_discovery_source": "threat_actor_ai_built",
-    "ai_discovery_notes": "Engineering-grade chained CI-trust-boundary attack attributed to TeamPCP. No AI-discovery component — the primitives (pull_request_target co-residency, actions/cache poisoning, /proc/<pid>/mem token-scraping) are documented human tradecraft. Tagged threat_actor_ai_built source enum to capture the AI-relevant impact-class framing without claiming AI-discovery of the underlying primitive.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Engineering-grade chained CI-trust-boundary attack attributed to TeamPCP. No AI-discovery component — the primitives (pull_request_target co-residency, actions/cache poisoning, /proc/<pid>/mem token-scraping) are documented human tradecraft.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "Attack methodology is engineering-grade — chained primitives across CI/CD, pnpm cache, and OIDC token handling. No evidence of AI-assisted exploit development; attribution: TeamPCP.",
     "active_exploitation": "confirmed",
@@ -122117,7 +122710,8 @@
       ]
     },
     "last_updated": "2026-05-13",
-    "discovery_attribution_note": "Community report into the elementary-data maintainers within four hours of the 2026-04-24 22:20 UTC push; ecosystem detection by JFrog, Snyk, Phylum follow-up. No AI-tool discovery attribution — incident was surfaced by package-registry monitoring + maintainer triage. Source: https://snyk.io/blog/malicious-release-of-elementary-data-pypi-package-steals-cloud-credentials-from-data-engineers/."
+    "discovery_attribution_note": "Community report into the elementary-data maintainers within four hours of the 2026-04-24 22:20 UTC push; ecosystem detection by JFrog, Snyk, Phylum follow-up. No AI-tool discovery attribution — incident was surfaced by package-registry monitoring + maintainer triage. Source: https://snyk.io/blog/malicious-release-of-elementary-data-pypi-package-steals-cloud-credentials-from-data-engineers/.",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2026-46300": {
     "name": "Fragnesia",
@@ -122382,7 +122976,8 @@
     "rwep_notes": "RWEP 35. poc_available +20, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
     "last_verified": "2026-08-08",
     "epss_percentile": 0.96913,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21626"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21626",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2024-3094": {
     "ai_assisted_weaponization": false,
@@ -122483,7 +123078,8 @@
     "rwep_notes": "RWEP 45. poc_available +20, active_exploitation +10, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
     "last_verified": "2026-08-08",
     "epss_percentile": 0.9971,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3094"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3094",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2024-3154": {
     "ai_assisted_weaponization": false,
@@ -122561,7 +123157,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-3154 and the cri-o GitHub security advisory cited in verification_sources."
     },
     "epss_percentile": 0.70262,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3154"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3154",
+    "ai_discovery_source": "vendor_research"
   },
   "CVE-2023-43472": {
     "ai_assisted_weaponization": false,
@@ -122637,7 +123234,8 @@
     },
     "last_verified": "2026-08-08",
     "epss_percentile": 0.98346,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-43472"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-43472",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2020-10148": {
     "ai_assisted_weaponization": false,
@@ -122730,7 +123328,8 @@
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-10148",
     "cisa_kev_due_date": "2022-05-03",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": false
+    "known_ransomware_use": false,
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2023-3519": {
     "ai_assisted_weaponization": false,
@@ -122825,7 +123424,8 @@
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-3519",
     "cisa_kev_due_date": "2023-08-09",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": true
+    "known_ransomware_use": true,
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2024-1709": {
     "ai_assisted_weaponization": false,
@@ -122925,7 +123525,8 @@
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-1709",
     "cisa_kev_due_date": "2024-02-29",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": true
+    "known_ransomware_use": true,
+    "ai_discovery_source": "vendor_research"
   },
   "CVE-2026-20182": {
     "ai_assisted_weaponization": false,
@@ -122937,7 +123538,7 @@
     "cisa_kev_date": "2026-05-14",
     "poc_available": false,
     "ai_discovered": false,
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-added with active-exploitation flag 2026-05-14.",
     "affected": "Cisco SD-WAN vManage and vEdge controllers across multiple software trains.",
@@ -123101,7 +123702,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-40635 and the containerd GitHub security advisory / Snyk Labs PoC cited in verification_sources."
     },
     "epss_percentile": 0.20357,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-40635"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-40635",
+    "ai_discovery_source": "human_researcher"
   },
   "MAL-2026-TANSTACK-MINI": {
     "ai_assisted_weaponization": false,
@@ -123187,7 +123789,8 @@
         "Credential-file reads (~/.npmrc, ~/.aws/credentials, GitHub token files) by a node/npm child process spawned from an @tanstack/* install."
       ],
       "_ioc_source_note": "Anchored to the TanStack security advisory 2026-05-11 and the npm advisories cited in verification_sources."
-    }
+    },
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2026-30623": {
     "ai_assisted_weaponization": false,
@@ -123201,7 +123804,7 @@
     "poc_available": true,
     "poc_description": "Public advisory documents the argv-string concatenation in MCP-client stdio transport.",
     "ai_discovered": false,
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "active_exploitation": "suspected",
     "affected": "Anthropic MCP SDK stdio transport versions prior to vendor security release (Apr 2026).",
     "affected_versions": [
@@ -123339,7 +123942,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-12686 and the Zero Day Initiative Pwn2Own Ireland 2025 disclosure cited in verification_sources."
     },
     "epss_percentile": 0.84882,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-12686"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-12686",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-62847": {
     "ai_assisted_weaponization": false,
@@ -123413,7 +124017,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62847 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.5349,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62847"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62847",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-62848": {
     "ai_assisted_weaponization": false,
@@ -123487,7 +124092,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62848 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.54875,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62848"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62848",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-62849": {
     "ai_assisted_weaponization": false,
@@ -123561,7 +124167,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62849 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.58102,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62849"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62849",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-59389": {
     "ai_assisted_weaponization": false,
@@ -123632,7 +124239,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59389 and the QNAP / Pwn2Own Ireland 2025 advisory cited in verification_sources."
     },
     "epss_percentile": 0.45668,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-59389"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-59389",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-11837": {
     "ai_assisted_weaponization": false,
@@ -123705,7 +124313,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-11837 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.71129,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-11837"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-11837",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2026-42945": {
     "name": "NGINX Rift",
@@ -123791,7 +124400,8 @@
         "Crafted URIs designed to match unnamed-capture rewrite patterns reaching nginx instances on the affected version range."
       ],
       "_ioc_source_note": "Anchored to the F5 advisory K000150420 and the nginx.org security advisories cited in verification_sources."
-    }
+    },
+    "ai_discovery_source": "bug_bounty_ai_augmented"
   },
   "CVE-2026-0300": {
     "name": "PAN-UID — Palo Alto Networks PAN-OS User-ID Authentication Portal RCE",
@@ -124269,8 +124879,8 @@
     "poc_available": true,
     "poc_description": "APT28 (Fancy Bear) in-wild weaponization of crafted LNK files that bypass Windows' Mark-of-the-Web protection. The exploitation chain pairs CVE-2026-32202 with CVE-2026-21513 to convert a downloaded LNK file into a SmartScreen-suppressed execution path. The chain represents an incomplete-patch class — CVE-2026-21510 attempted to close the same MOTW-bypass surface but did so incompletely, enabling the CVE-2026-32202 re-exploit primitive.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "APT28 weaponization discovered by Microsoft MAPP partners + Help Net Security reporting; no AI-tool credit on the defender-side discovery. Threat-actor side (APT28) is well-known nation-state tradecraft, not AI-assisted exploit development. Classed as vendor_research per Hard Rule #1.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "APT28 weaponization discovered by Microsoft MAPP partners + Help Net Security reporting; no AI-tool credit on the defender-side discovery. Threat-actor side (APT28) is well-known nation-state tradecraft, not AI-assisted exploit development.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted exploit development reported. APT28's LNK-weaponization toolkit predates AI-assisted exploit-development tooling by years; the CVE-2026-32202 primitive is an extension of established LNK tradecraft, not an AI-discovery.",
     "active_exploitation": "confirmed",
@@ -124386,8 +124996,8 @@
     "poc_available": true,
     "poc_description": "Picus Security 'BlueHammer' / RedSun published a working PoC BEFORE Microsoft released the patch — true zero-day disclosure. The race window is in Defender's file-remediation logic: after Defender flags a malicious file, the remediation step opens the path-to-quarantine sequence non-atomically, and an attacker-controlled junction / symlink swap during the TOCTOU window redirects the remediation operation against a SYSTEM-owned file, producing an arbitrary-file-overwrite primitive that escalates to SYSTEM via standard overwrite-to-LPE techniques.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "Discovery by Picus Security research team (the BlueHammer / RedSun writeup); no AI-tool credit in their blog post. Conventional Windows-Defender internals research. Classed as vendor_research per Hard Rule #1 (Picus is a third-party security-research firm, not a model-discovery tool).",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovery by Picus Security research team (the BlueHammer / RedSun writeup); no AI-tool credit in their blog post. Conventional Windows-Defender internals research.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted exploit development. The race-window primitive is conventional TOCTOU race-condition exploitation; the novelty is the target (Defender's remediation pipeline) not the technique.",
     "active_exploitation": "confirmed",
@@ -124507,8 +125117,8 @@
     "poc_available": true,
     "poc_description": "Live payload — three malicious versions (node-ipc 9.1.6, 9.2.3, 12.0.1) were published to the public npm registry by attacker-controlled account `atiertant` on 2026-05-14 and remained installable for the exposure window before npm yank. The malicious build IS the PoC.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem telemetry detection by Socket, StepSecurity, Semgrep, and Datadog Security Labs within hours of publication; The Hacker News surfaced the consolidated report. ai_discovery_source set to `vendor_research` because the enum does not include an `ecosystem_detection` value; the attribution note records the actual provenance.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem telemetry detection by Socket, StepSecurity, Semgrep, and Datadog Security Labs within hours of publication; The Hacker News surfaced the consolidated report.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-tooling credit on the payload-development side. The 80 KB obfuscated IIFE follows a conventional minifier-plus-string-encoding pattern; no AI-generated code fingerprint reported by the responding firms.",
     "active_exploitation": "confirmed",
@@ -124729,7 +125339,8 @@
         "Kernel/audit signatures of ptrace attach to a setuid binary immediately before its exit on an affected kernel."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2026-46333 and the public analysis cited in verification_sources."
-    }
+    },
+    "ai_discovery_source": "human_researcher"
   },
   "MAL-2026-SHAI-HULUD-OSS": {
     "name": "Shai-Hulud worm framework (TeamPCP open-source release)",
@@ -124854,7 +125465,8 @@
       "GHSA-w37p-236h-pfx3"
     ],
     "aliases_note": "CVE-2026-44484 / OSV MAL-2026-3201 / GHSA-w37p-236h-pfx3 cover the PyPI lightning (PyTorch Lightning) sub-incident of this Mini Shai-Hulud wave — distinct ids for the same campaign, tracked here rather than as a separate entry (adversarial dedup 2026-05-30 confirmed it is the PyPI side of this wave, not a distinct incident).",
-    "_editorial_note_lightning": "PyPI lightning (PyTorch Lightning) 2.6.2/2.6.3 compromise (disclosed 2026-04-30, CVE-2026-44484) folded into this entry on 2026-05-30: an adversarial dedup found it is the PyPI side of the Mini Shai-Hulud wave already scoped here (shared Bun-runtime/router_runtime.js IoCs, same campaign/timeline), not a distinct incident warranting a separate MAL-* key."
+    "_editorial_note_lightning": "PyPI lightning (PyTorch Lightning) 2.6.2/2.6.3 compromise (disclosed 2026-04-30, CVE-2026-44484) folded into this entry on 2026-05-30: an adversarial dedup found it is the PyPI side of the Mini Shai-Hulud wave already scoped here (shared Bun-runtime/router_runtime.js IoCs, same campaign/timeline), not a distinct incident warranting a separate MAL-* key.",
+    "ai_discovery_source": "unknown"
   },
   "CVE-2024-21762": {
     "ai_assisted_weaponization": false,
@@ -125076,7 +125688,7 @@
     "poc_available": false,
     "poc_description": "No public PoC; exploit observed in targeted attacks against specific individuals consistent with commercial-spyware / nation-state operator tradecraft. Apple characterized the activity as 'extremely sophisticated'.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Discovery credit not publicly disclosed by Apple at time of patch; targeted-spyware operator activity rather than AI-assisted discovery.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -125405,7 +126017,7 @@
     "poc_available": true,
     "poc_description": "Public 'Glass Cage' chain on GitHub uses CVE-2025-43300 as the initial-access primitive (TIFF SamplesPerPixel vs JPEG SOF3 metadata mismatch). Apple confirmed in-the-wild exploitation as part of an 'extremely sophisticated attack' against targeted individuals.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Apple-internal disclosure; full attribution undisclosed.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -125489,7 +126101,7 @@
     "poc_available": true,
     "poc_description": "Public 'chronomaly' PoC on GitHub (farazsth98/chronomaly) targets vulnerable x86_64 Linux kernels v5.10.x. Race between handle_posix_cpu_timers() and posix_cpu_timer_del() triggered when a task exits while CPU timers are being removed; improper exit_state handling opens an LPE window. Confirmed used as a zero-day to escape Android application sandbox.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Google Android Security Bulletin September 2025 attribution; no AI-tool credit.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -125728,7 +126340,7 @@
     "poc_available": true,
     "poc_description": "Public Rapid7 advisory + Metasploit module + ishwardeepp PoC on GitHub. Invalid-UTF-8 byte sequences interact with PostgreSQL string-escaping routines and psql meta-command processing to permit injection and arbitrary command execution. Exploited in BeyondTrust + US Treasury breaches.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Rapid7 disclosure during BeyondTrust incident triage; no AI-tool attribution.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -125813,7 +126425,7 @@
     "poc_available": true,
     "poc_description": "Wiz Research disclosure with full technical details. 13-year-old UAF in Redis Lua interpreter; post-auth attacker sends crafted Lua script to escape sandbox and achieve native code execution. Default Redis deployments without auth enable unauthenticated exploitation.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Wiz Research disclosure (human-led); no AI-tool credit.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "suspected",
@@ -125894,7 +126506,7 @@
     "poc_available": true,
     "poc_description": "Public exploit code observed; active opportunistic scanning of internet-exposed MongoDB instances reported. Mismatched length fields in zlib-compressed wire-protocol headers cause MongoDB Server to return uninitialized heap memory to unauthenticated clients.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Bitsight + MongoDB-coordinated disclosure; no AI-tool attribution.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -125977,8 +126589,8 @@
     "poc_available": true,
     "poc_description": "Public PoC tooling (moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS). Attacker uses malformed WINDOW_UPDATE, PRIORITY, or DATA frames to trigger server-side stream resets while backend continues processing, bypassing MAX_CONCURRENT_STREAMS and exhausting resources. Disclosed 2025-08-13 by Tel Aviv University + Imperva researchers.",
     "ai_discovered": false,
-    "ai_discovery_source": "academic_ai_fuzzing",
-    "ai_discovery_notes": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. ai_discovery_source set to academic_ai_fuzzing as the closest enum match for protocol-fuzzing research, though specific AI-fuzzing tool credit was not published.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. No AI-fuzzing tool is credited in the published research.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "none",
     "affected": "HTTP/2 implementations including Apache Tomcat, Netty (CVE-2025-55163), Varnish, Fastly, F5, SUSE-shipped libraries, Wind River. Estimated 2.8M+ internet-facing instances vulnerable.",
@@ -126033,7 +126645,7 @@
         "published_date": "2025-08-13"
       }
     ],
-    "discovery_attribution_note": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. ai_discovery_source set to academic_ai_fuzzing as the closest enum match for protocol-fuzzing research, though specific AI-fuzzing tool credit was not published. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-8671",
+    "discovery_attribution_note": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. No AI-fuzzing tool is credited in the published research. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-8671",
     "live_patch_tools": [],
     "cwe_refs": [
       "CWE-1395"
@@ -126059,7 +126671,7 @@
     "poc_available": false,
     "poc_description": "Pre-emptive disclosure — Google's Big Sleep AI agent identified the bug from threat-intelligence signals before any in-the-wild exploit landed. Google publicly stated this was 'the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild'.",
     "ai_discovered": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_discovery_date": "2025-07-15",
     "ai_discovery_notes": "Google DeepMind + Project Zero 'Big Sleep' AI agent. First documented AI-agent zero-day prevention. Integer overflow → array out-of-bounds read in SQLite < 3.50.2.",
     "ai_assisted_weaponization": false,
@@ -126140,7 +126752,7 @@
     "poc_available": true,
     "poc_description": "OX Security disclosure with full chain: malicious video URL submitted to vLLM API → OpenCV decodes via bundled FFmpeg 5.1.x → heap overflow in JPEG2000 decoder. Heap address leak primitive sourced from PIL error message in earlier vulnerable vLLM versions facilitates exploitation.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "OX Security human research disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "suspected",
@@ -126222,7 +126834,7 @@
     "poc_available": true,
     "poc_description": "Crafted file upload to Ollama's model-quantization API causes out-of-bounds heap read; server process memory (potentially including model weights, conversation context, API keys) leaks to unauthenticated client.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Coordinated disclosure to Ollama security team.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "none",
@@ -126302,7 +126914,7 @@
     "poc_available": true,
     "poc_description": "Cyata 'LangGrinch' writeup demonstrates end-to-end exploitation. dumps()/dumpd() do not escape free-form dictionaries containing the internal 'lc' key marker; attacker-controlled LLM response fields (additional_kwargs / response_metadata) are deserialized as legitimate LangChain objects, leaking secrets and enabling code execution paths.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Cyata research team discovery via prompt-injection attack-surface analysis.",
     "ai_assisted_weaponization": true,
     "ai_assisted_notes": "Exploitation depends on prompt-injection triggering an LLM to emit a payload-shaped response — i.e. the LLM IS the weaponization primitive.",
@@ -126389,7 +127001,7 @@
     "poc_available": true,
     "poc_description": "In-the-wild exploit observed by Microsoft Threat Intelligence prior to disclosure. Huntress reported PDB-path evidence (folder '2024_02_19') suggesting the exploit chain pre-dates disclosure by ~12 months. Used in ransomware operations per CISA February 2026 follow-up.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft Threat Intelligence Center disclosure; no AI-tool attribution.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126475,7 +127087,7 @@
     "poc_available": true,
     "poc_description": "Active exploitation by ransomware groups confirmed by CISA in February 2026 follow-up. Chained with CVE-2025-22224 (TOCTOU) and CVE-2025-22226 (memory leak) for full VM-escape → hypervisor-management access.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft Threat Intelligence Center co-disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126557,7 +127169,7 @@
     "poc_available": true,
     "poc_description": "Third-in-chain CVE in the VMSA-2025-0004 cluster; HGFS (Host Guest File System) memory leak provides the heap-address oracle used to weaponize CVE-2025-22224 + CVE-2025-22225. Active exploitation confirmed by Broadcom as 'observed in attacks'.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft Threat Intelligence Center co-disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126641,7 +127253,7 @@
     "poc_available": true,
     "poc_description": "Live malicious payload in ultralytics 8.3.41 and 8.3.42 (the first 'remediation' release inadvertently re-shipped the malicious code). XMRig cryptominer downloaded post-install via downloader code injected through a GitHub Actions script-injection in the build environment by openimbot.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "ReversingLabs + Wiz + HiddenLayer concurrent ecosystem-telemetry detection.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126727,7 +127339,7 @@
     "poc_available": true,
     "poc_description": "Live malicious packages — Ruby gems harvested env vars + SSH keys + AWS credentials + .npmrc + .netrc + GitHub CLI config + RubyGems credentials to a hidden C2 endpoint. Go modules modified GITHUB_ENV, poisoned GOPROXY, weakened checksum protections, tampered with go.sum, and planted fake `go` wrappers in workflow execution paths.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Socket.dev research disclosure; concurrent reporting by other supply-chain firms.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126816,7 +127428,7 @@
     "poc_available": true,
     "poc_description": "11 PyPI packages published by a single threat actor between 2025-05-04 and 2025-05-24, split across four payload variants targeting the Solana ecosystem (browser-stored credentials, crypto wallets, sensitive session cookies). Multiple downstream variants — coloramapkgsw, coloramapkgsdow, coloramashowtemp, coloramapkgs, readmecolorama, colorizator, coloraiz, and related — extend the colorama / colorizr typosquat pattern.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Imperva Threat Research + Checkmarx + Check Point ecosystem-telemetry detection.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127311,7 +127923,7 @@
     "poc_available": false,
     "poc_description": "Pre-emptive AI-agent discovery; no public PoCs at disclosure time. Bugs reported through standard upstream-vendor responsible-disclosure channels with patches landing before public PoC publication.",
     "ai_discovered": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_discovery_date": "2025-08-04",
     "ai_discovery_notes": "Google DeepMind + Project Zero 'Big Sleep' AI agent (Gemini-backed) reported the first 20 vulnerabilities it found, disclosed publicly by Heather Adkins on 2025-08-04. Targets included FFmpeg media library and ImageMagick editing suite — both with massive downstream redistribution surface.",
     "ai_assisted_weaponization": false,
@@ -140529,7 +141141,7 @@
     "poc_available": false,
     "poc_description": "CISA KEV-listed with Microsoft 'Exploitation Detected'. No public proof-of-concept repository verified at curation time; exploitation is confirmed regardless of public PoC status.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Microsoft's MSRC process; no AI-discovery attribution surfaced.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization reported.",
@@ -140643,7 +141255,7 @@
     "poc_available": false,
     "poc_description": "CISA KEV-listed (confirmed exploitation). No public proof-of-concept repository referenced by NVD or the Trend Micro advisory at curation time.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Trend Micro / ZDI coordinated disclosure; no AI-discovery attribution surfaced.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization reported.",
@@ -140756,7 +141368,7 @@
     "poc_available": false,
     "poc_description": "CISA KEV-listed with Microsoft 'Exploitation Detected'. No public proof-of-concept repository verified at curation time.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Microsoft's MSRC process; no AI-discovery attribution surfaced.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization reported.",
@@ -166603,7 +167215,7 @@
     "poc_available": true,
     "poc_description": "KeyTrap PoC zones and analysis published with the Feb 2024 coordinated disclosure; ISC/NLnet Labs/PowerDNS advisories document the attack and the work-bounding fixes.",
     "ai_discovered": false,
-    "ai_discovery_source": "academic_ai_fuzzing",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by the ATHENE / Goethe University Frankfurt research group (KeyTrap, disclosed Feb 2024). Academic protocol research, not AI-attributed by the disclosers; ai_discovered remains false.",
     "active_exploitation": "suspected",
     "active_exploitation_notes": "High-profile coordinated disclosure (BIND, Unbound, PowerDNS, Knot, Dnsmasq patched in lockstep Feb 2024). Single crafted DNSSEC response can stall a validating resolver for an extended period. Internet-scale concern; observed scanning but no confirmed sustained campaign — suspected.",
@@ -166686,7 +167298,7 @@
     "poc_available": true,
     "poc_description": "Published with the Feb 2024 coordinated DNSSEC disclosure; ISC/NLnet Labs/PowerDNS advisories document the NSEC3 work-bounding fix.",
     "ai_discovered": false,
-    "ai_discovery_source": "academic_ai_fuzzing",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Disclosed alongside KeyTrap by the ATHENE / Goethe University Frankfurt group (Feb 2024). Academic protocol research; ai_discovered false.",
     "active_exploitation": "suspected",
     "active_exploitation_notes": "Coordinated multi-vendor disclosure and patching (Feb 2024). Crafted NSEC3 responses force excessive hashing; internet-scale concern. Observed scanning, no confirmed sustained campaign — suspected.",
@@ -167418,7 +168030,7 @@
     "poc_available": false,
     "poc_description": "The Microsoft Security Update Guide entry documents the use-after-free and ships the fix, but no public proof-of-concept exploit is published; the in-the-wild use is consistent with a post-compromise privilege-escalation step rather than a public exploit.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed and patched by Microsoft via the Security Update Guide (https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30400) in the May 2025 Patch Tuesday cycle. The DWM Core Library is a core Windows desktop-compositor component, not an AI surface.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization; a use-after-free in the Windows DWM Core Library is abused as a local privilege-escalation primitive.",
@@ -167732,7 +168344,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept is published. Palo Alto Networks reports limited exploit attempts against unpatched, un-mitigated PAN-OS devices and marks the vendor exploit maturity ATTACKED, but neither the vendor advisory nor public research has released exploit code.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed in the Palo Alto Networks security advisory for CVE-2026-0257 (https://security.paloaltonetworks.com/CVE-2026-0257). No AI tool is credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization observed; the GlobalProtect portal/gateway authentication surface is reachable and bypassable directly over the network.",
@@ -168399,7 +169011,7 @@
     "poc_available": false,
     "poc_description": "The GitHub Security Advisory documents the mechanism - the POST /mcp-rest/test/connection and /mcp-rest/test/tools/list endpoints accept MCP server configs that spawn subprocesses - but ships no public proof-of-concept exploit.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed via the BerriAI GitHub Security Advisory (https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g). The abused surface is an LLM gateway/proxy (LiteLLM) and its Model Context Protocol (MCP) integration.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization; an authenticated MCP test endpoint on an LLM gateway accepts server configs that spawn arbitrary subprocesses on the host.",
@@ -168619,7 +169231,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept exploit. The vendor advisory documents the abused function (lsws.redisAble / cpanel_jsonapi_func=redisAble) and a log-based detection grep, but does not publish exploit code.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "vendor_research",
     "ai_discovery_notes": "Disclosed by LiteSpeed Technologies via their security update (https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/) and catalogued in NVD; CISA KEV-listed 2026-05-26. Identified through vendor incident response after in-the-wild exploitation, not AI tooling.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No evidence of AI-assisted weaponization. The flaw is improper privilege management on a control-panel plugin function reachable by any panel user.",
@@ -168730,7 +169342,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept is published. Check Point and CISA confirm in-the-wild exploitation against IKEv1-enabled gateways, but no exploit code has been released by the vendor or public research at the time of curation.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed in the Check Point security advisory sk185033 and accompanying blog post (https://support.checkpoint.com/results/sk/sk185033). No AI tool is credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization observed; the IKEv1 certificate-validation logic flaw is exploitable directly over the network against gateways accepting legacy Remote Access clients.",
@@ -168950,7 +169562,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept. This is a delivered supply-chain compromise rather than an exploit against a software flaw: the malicious code shipped inside the official installer, so the 'exploit' was the trojanized package itself reaching users via the legitimate download path.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "vendor_research",
     "ai_discovery_notes": "Disclosed by the vendor (AVB Disc Soft) via the DAEMON Tools security-incident notice (https://blog.daemon-tools.cc/post/security-incident) and catalogued in NVD; CISA KEV-listed 2026-05-27. The compromise was identified through the vendor's incident response, not AI tooling.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No evidence of AI-assisted weaponization. The attacker compromised the vendor's build/distribution infrastructure and trojanized signed binaries; the technique is classic build-pipeline compromise.",
@@ -169061,7 +169673,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited unauthenticated deserialization RCE. Unauthenticated deserialization of crafted input executes code and plants JSP webshells on Windchill/FlexPLM.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed by PTC (advisory published 2026-06-17). No AI tool credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "In-the-wild webshell deployment; no AI-build attribution.",
@@ -169167,7 +169779,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited unauthenticated SSRF-to-root. Unauthenticated SSRF in the WebDialer HTTP handler chained to attacker-controlled file write and root escalation; public PoC available.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed by Cisco PSIRT (advisory cisco-sa-cucm-ssrf-cXPnHcW) on 2026-06-03. No AI tool credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "Public PoC exploit code released by security researchers; no AI-build attribution.",
@@ -169705,7 +170317,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited missing authentication for a critical function. watchTowr Labs published a working pre-auth RCE PoC chaining the unauthenticated sidecar restore endpoint through pg_restore connection-string injection and lo_export to write/overwrite Splunk Python scripts, yielding code execution as the splunk user.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. The Splunk vendor advisory SVD-2026-0603 credits discovery to a named human researcher, \"Alex Hordijk (hordalex)\" (https://advisory.splunk.com/advisories/SVD-2026-0603). No primary source credits any named AI system with finding the flaw. watchTowr Labs (Piotr Bazydlo @chudyPB and Yordan Ganchev) published an independent technical analysis and PoC AFTER vendor disclosure — they reverse-engineered the patch, they did not discover the vulnerability (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/).",
     "ai_assisted_weaponization": true,
     "ai_assisted_notes": "watchTowr Labs states their public exploit was built with assistance from \"Project Red,\" their internal LLM-driven vulnerability reproduction harness, which was used to identify the vulnerable API endpoint and craft exploitation requests; human researchers Piotr Bazydlo and Yordan Ganchev performed the analysis and finalized the pg_dump/pg_restore chain (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/, corroborated by https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html). Caveat: this named-AI assistance applies to watchTowr's research/PoC, not to any confirmed in-the-wild attacker tooling.",
@@ -169925,7 +170537,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited symlink-following cross-account file access. Two public GitHub PoCs (e.g. fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) demonstrate planting a symlink that the root-running LiteSpeed plugin follows during certificate/usage JSON-API calls, escaping CageFS to read/write files across tenant boundaries and reach root.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. The LiteSpeed vendor advisory credits discovery/reporting to \"the team at Namecheap\" (a hosting provider), who reported it on 2026-05-31; no named AI tool/agent is credited anywhere. Source: https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ and https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html . (One third-party write-up at yazoul.net notes it was \"drafted with large-language-model assistance\" — that refers to the blog prose, not the vulnerability discovery or exploit, so it does not establish AI discovery.)",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates the exploit was AI-built. Two public PoC exploits exist (e.g. github.com/fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) but are human-authored; no AI weaponization is claimed or evidenced.",
@@ -170470,7 +171082,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited OS command injection. watchTowr Labs published a full \"SonicBoom\" write-up and exploit chain (CVE-2024-38475 admin session-token leak → CVE-2023-44221 command injection) demonstrating an unauthenticated-to-remote-shell path on SMA100 appliances; public technical PoC available.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. SonicWall's advisory SNWLID-2023-0018 and corroborating reporting credit human security researcher Wenjie Zhong (alias \"H4lo\") of DBappSecurity Co. Ltd.'s Webin lab with finding and reporting the flaw; it was disclosed in December 2023. No AI tool/agent is named in any primary source. Sources: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 ; https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public end-to-end exploit chain (codenamed \"SonicBoom\") was researched, built, and documented by human analysts at watchTowr Labs. Source: https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-cve-2024-38475/",
@@ -170578,7 +171190,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited authenticated code injection to root. No public PoC or exploit code released; KEV-confirmed in-the-wild abuse where an admin-privileged Fabric OS user supplies a crafted IP-address value to inject code and gain full root execution on Fabric OS 9.1.0 through 9.1.1d6.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "No AI involvement in discovery. The Broadcom/Brocade vendor advisory (BSA-2025-2930, doc 25602) credits no researcher, firm, or tool at all; neither The Hacker News nor CSO Online reporting names a discoverer. There is no primary source crediting any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, GTIG, etc.) with finding this. Per the conservative rule, ai_discovered=FALSE. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602 ; https://thehackernews.com/2025/04/cisa-adds-actively-exploited-broadcom.html",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No public exploit code or PoC exists, and no source indicates AI-assisted exploit development. Exploitation is KEV-confirmed in-the-wild but no weaponization tooling, exploit author, or AI-build claim has been published.",
@@ -170793,7 +171405,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited webshell creation on the web server. No public exploit code or technical PoC has been released; the vendor classes the flaw as \"unspecified,\" and it was exploited only as an in-the-wild zero-day via authenticated webshell creation/execution against the Commvault Web Server.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "No AI tool is credited with discovery. The vulnerability surfaced through incident detection: Microsoft notified Commvault of anomalous activity within Commvault's Azure environment on 2025-02-20, exposing the nation-state zero-day exploitation. Both the Commvault advisory (https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html) and downstream reporting (Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-3928) name no discoverer/AI system — it was found-in-the-wild via cloud-provider telemetry, not by Big Sleep/XBOW/ZeroPath/o-series or any named AI. Conservative determination: FALSE.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the exploit/webshell tooling to any AI system. The observed weaponization was conventional: an authenticated actor wrote and executed .aspx webshells on the Commvault Web Server, then pivoted to stored Azure/M365 application secrets. No AI-assisted exploit development is reported.",
@@ -171123,7 +171735,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited CoreAudio memory-corruption RCE via a crafted media file. No clean standalone weaponized PoC is publicly published for the bug itself; a Full Disclosure write-up (seclists, Jun 2025) describes the zero-click iMessage chain (CVE-2025-31200 CoreAudio RCE + CVE-2025-31201 PAC bypass), and an independent researcher reported a live crafted-media-file trigger on iOS 18.2 to Apple.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. Apple's security advisory (support.apple.com/en-us/122282) credits the fix to \"Apple\" and the discovery is jointly attributed to Apple and Google's Threat Analysis Group (TAG) — a human threat-intelligence team that tracks commercial/mercenary surveillance vendors. An independent researcher (Joseph Goydish II) is also reported to have found and disclosed a live CoreAudio media-file zero-day to Apple in Dec 2024. No primary source credits any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, etc.) with discovery. Sources: https://support.apple.com/en-us/122282 ; https://www.bleepingcomputer.com/news/security/apple-fixes-two-zero-days-exploited-in-targeted-iphone-attacks/ ; https://www.wiz.io/vulnerability-database/cve/cve-2025-31200",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. The in-the-wild exploitation matches the commercial/mercenary-spyware pattern (zero-click iMessage delivery against targeted high-risk individuals, co-reported by Google TAG). No primary source attributes the exploit chain to any AI tooling.",
@@ -171675,7 +172287,7 @@
     "poc_available": true,
     "poc_description": "Public PoC/exploit available. Forge a __VIEWSTATE/ViewState payload signed with the product's hard-coded machineKey containing a .NET deserialization gadget chain and POST it to the CentreStack/Triofox portal to achieve unauthenticated RCE as the IIS portal app-pool user; Huntress developed working PoC exploits.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. Found during active in-the-wild exploitation by the Huntress SOC: on 2025-04-11 an internal Huntress 0-day detector alerted on the exploitation, and Huntress threat researchers (human team) then analyzed the root cause (hard-coded ASP.NET machineKey enabling ViewState deserialization). No named AI tool/agent is credited with discovery in any primary source. Vendor (Gladinet) advisory and NVD note exploitation in the wild since March 2025. Source: https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source credits any AI system with weaponization. The exploitation technique is the well-established public ASP.NET ViewState deserialization attack (ysoserial.net-style gadget chains) applied to a leaked/hard-coded machineKey; Huntress researchers hand-developed proof-of-concept exploits. No AI-assisted exploit development is reported.",
@@ -172004,7 +172616,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; the only known working exploit is the private ForumTroll/Memento Labs zero-day chain. Public technical write-ups (Kaspersky/Securelist, elasticninja, SecureLayer7) describe the root cause — an unvalidated sentinel handle (-2 pseudo-handle) mishandled during Mojo broker-side handle duplication — enabling the sandbox escape when paired with a renderer RCE.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by human researchers at Kaspersky's Global Research & Analysis Team (GReAT) — Boris Larin and Igor Kuznetsov — who detected the in-the-wild exploit chain during \"Operation ForumTroll\" and reported it to Google on 2025-03-20. No AI tool/agent is credited with discovery in any primary source; Kaspersky attributes detection to its own telemetry/technologies. Sources: https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ and https://www.kaspersky.com/about/press-releases/kaspersky-discovers-sophisticated-chrome-zero-day-exploit-used-in-active-attacks",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization. The exploit was attributed to the ForumTroll APT / Memento Labs (ex-Hacking Team) spyware tooling (Dante), with no mention of any named AI system in the build chain.",
@@ -172647,7 +173259,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. Unauthenticated super-admin takeover by replaying crafted CSF/Security-Fabric proxy requests over the Node.js websocket alternate channel with known upstream/downstream device serial numbers; public technical analysis exists (watchTowr, Forescout) but no full weaponized exploit script is publicly posted.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. The vendor advisory FG-IR-24-535 and reporting credit human researchers: CVE-2025-24472 was reported to Fortinet PSIRT by \"Sonny of watchTowr\" under responsible disclosure, and the in-the-wild exploitation (SuperBlack/Mora_001 campaign) was discovered by Forescout Research (Vedere Labs) human analysts. No named AI system is credited with discovery in any primary source. Sources: https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://www.quorumcyber.com/threat-intelligence/new-ransomware-operator-mora_001-exploits-fortinet-vulnerabilities-with-superblack/",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes AI tooling to exploit development or weaponization. The SuperBlack toolchain (Forescout-attributed) consists of conventional custom scripts, a LockBit 3.0-derived encryptor, and a custom wiper; no AI-assisted exploit-generation is reported.",
@@ -172757,7 +173369,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. UNC3886 in-the-wild chain (no public exploit PoC): from a root FreeBSD shell, inject base64-decoded loader.bin/pc.bin into a hung cat process via dd to /proc/pid/mem, overwrite the fclose GOT entry, then send EOF so cat runs the loader and loads payload.bin (lmpad backdoor), bypassing Veriexec.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Credited to Mandiant / Google Threat Intelligence Group (GTIG), a human threat-intel team that found UNC3886 exploiting it in the wild on Juniper routers; no named AI tool is credited with discovery. Quote: \"This specific technique is now tracked as CVE-2025-21590, as detailed in Juniper Network's security bulletin JSA93446.\" Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development. UNC3886 hand-built the process-injection chain (loader.bin/pc.bin/payload.bin, /proc/pid/mem writes, GOT overwrite of fclose) to bypass Junos Veriexec and load TINYSHELL-based PIC backdoors. No AI tooling is referenced in Mandiant's analysis. Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
@@ -172871,7 +173483,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; exploitation is by delivering a specially crafted VHD/VHDX whose malformed NTFS metadata overflows an ntfs.sys heap buffer when the victim mounts it, yielding local code execution.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "No AI tool or agent is credited. The three NTFS file-system zero-days patched together (CVE-2025-24993 RCE, CVE-2025-24991 OOB-read, CVE-2025-24984 info-disclosure) were reported anonymously to Microsoft, per The Hacker News coverage of the March 2025 Patch Tuesday (https://thehackernews.com/2025/03/urgent-microsoft-patches-57-security.html). The named-researcher discovery in the same batch (ESET's Filip Jurcacko, via the PipeMagic backdoor) applies to a SEPARATE CVE, CVE-2025-24983 (Win32k use-after-free LPE) — not to this NTFS RCE. Microsoft's advisory lists no acknowledged finder for CVE-2025-24993.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source describes AI-assisted exploit development or weaponization for CVE-2025-24993. Public reporting describes a conventional VHD-mount trigger; no AI tooling is referenced in any exploitation account.",
@@ -172984,7 +173596,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public PoC located; exploitation requires luring a local user to mount a crafted malicious VHD/VHDX whose malformed NTFS metadata triggers an out-of-bounds heap read, leaking memory contents to the attacker.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "No named AI system is credited. Microsoft's acknowledgments list this NTFS vulnerability as reported anonymously (no individual or vendor named). Independent reporting (Krebs on Security, Zero Day Initiative, BleepingComputer) confirms the anonymous-reporter credit and links it to the same entity that reported the sibling VHD-mounting flaws. By contrast, only CVE-2025-24983 (Win32k) in this March 2025 batch carries a named human discoverer (Filip Jurcacko / ESET). No AI attribution anywhere. Sources: https://krebsonsecurity.com/2025/03/microsoft-6-zero-days-in-march-2025-patch-tuesday/ ; https://www.zerodayinitiative.com/blog/2025/3/11/the-march-2025-security-update-review",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the in-the-wild exploit code or its weaponization to any AI tool or AI-assisted workflow. Exploitation is described as crafting a malicious VHD/VHDX and socially engineering a user into mounting it; no AI-generation claim is made by Microsoft, ESET, Trend Micro, or ZDI.",
@@ -173101,7 +173713,7 @@
     "poc_available": true,
     "poc_description": "Public PoC/exploit available. Public detection/mitigation scripts and PoC material exist (vicarius.io vsociety, GitHub); exploitation triggers by inducing a victim to mount a specially crafted VHD whose malformed FAT structures overflow fastfat.sys for kernel code execution.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft's MSRC advisory credits an anonymous reporter for CVE-2025-24985 (acknowledged together with the same-month NTFS bugs CVE-2025-24984/24991/24993, all attributed to \"Anonymous\"). No named AI tool/agent is credited with discovery. Multiple independent reports (BleepingComputer, ZDI, Tenable) describe it as disclosed/reported anonymously. Sources: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985 ; https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2025-patch-tuesday-fixes-7-zero-days-57-flaws/",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source describes any AI tool or agent being used to weaponize or develop an exploit for CVE-2025-24985. Exploitation was observed in the wild as a zero-day; the delivery technique (malicious VHD mounted by a tricked local user) is conventional and pre-dates this CVE. No AI involvement reported.",
@@ -173215,7 +173827,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; exploitation requires physically mounting a crafted NTFS volume (malicious USB/VHD) so the NTFS driver logs heap memory the attacker then reads back to disclose sensitive data.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "No named AI system credited. The three March 2025 Windows NTFS vulnerabilities (CVE-2025-24984, -24991, -24993) were reported to Microsoft anonymously per Patch Tuesday coverage; the MSRC advisory and NVD list no acknowledgment. Reported anonymously to a vendor PSIRT is a human/anonymous disclosure, not AI discovery. Sources: https://www.theregister.com/2025/03/12/patch_tuesday/ , https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the discovery, PoC, or any in-the-wild exploitation tooling for CVE-2025-24984 to an AI system. KEV-confirmed exploitation carries no public actor attribution and no public weaponization narrative.",
@@ -173326,7 +173938,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public exploit code from the original disclosure; the working exploit was the in-the-wild Storm-2460/PipeMagic build that races the W32PROCESS UAF in Win32k to gain a kernel primitive and elevate a local process to SYSTEM on Windows 8.1 / Server 2012 R2 and other pre-1809 builds.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by ESET researcher Filip Jurcacko, who found the zero-day exploited in the wild and reported it to Microsoft. ESET Research's disclosure (infosec.exchange/@ESETresearch/114148213672762050) and BleepingComputer credit the human ESET research team; no AI tool/agent is named with discovery. Found in-the-wild, not via an automated AI discovery system. https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-windows-kernel-zero-day-exploited-since-2023/",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source credits an AI system with weaponizing or developing the exploit. The exploit was crafted and operated by the Storm-2460 threat cluster and delivered via the PipeMagic backdoor; the only AI tie-in is thematic social-engineering (PipeMagic later masqueraded as an open-source ChatGPT desktop app), which is lure branding, not AI-assisted exploit development.",
@@ -173479,7 +174091,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to WordPress via responsible disclosure by TF1T, dtro, and haongo. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-60137 (CWE-89, CVSS 5.9 WPScan CNA) + CISA KEV (added 2026-07-21) + WordPress GHSA-fpp7-x2x2-2mjf.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-08-04). Named vendors (Rapid7, Tenable, IONIX) report in-the-wild exploitation of the wp2shell chain within days of the 2026-07-17 disclosure. Standalone, the SQLi is only reachable when a plugin/theme passes untrusted input (hence the AC:H / 5.9 CNA rating); its real-world weight is as the SQLi half of the unauthenticated RCE chain.",
@@ -173577,7 +174189,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to WordPress via responsible disclosure by Adam Kues of Assetnote / Searchlight Cyber. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-63030 (CWE-436, CVSS 9.8 WPScan CNA) + CISA KEV (added 2026-07-21) + WordPress GHSA-ff9f-jf42-662q + Rapid7 disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-21 with an accelerated 3-day due date (2026-07-24). Multiple vendors (Rapid7, Tenable, NetSPI, CyCognito) confirm in-the-wild exploitation of the wp2shell pre-auth RCE chain against default WordPress installs. This CVE is the route-confusion half that provides the validation bypass; CVE-2026-60137 provides the SQLi primitive. Temporary mitigation: block /wp-json/batch/v1 at a WAF.",
@@ -173683,7 +174295,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by human researchers at Trend Research via the Zero Day Initiative (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira). No AI tooling credited. Note: Langflow is an LLM/agent application framework, but this flaw is a conventional unauthenticated web-app RCE, not a model-level attack.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-0770 (CWE-829, CVSS 9.8) + CISA KEV (added 2026-07-21) + ZDI-26-036 (ZDI-CAN-27325) + GHSA-g22f-v6f7-2hrh. Distinct from CVE-2025-3248 (a separate flaw on the same endpoint, fixed in the 1.3.x line); CVE-2026-0770 is in exec_globals handling and reaches installs up to 1.7.3.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-07-24). KEVIntel first observed in-the-wild exploitation 2026-06-27 with 220+ attempts from 64 unique IPs, deploying second-stage malware and stealing AWS credentials, environment variables, and container/cloud metadata. Exploitation is opportunistic and mass-scanned, indicating commodity weaponization. Reported to the vendor 2025-07-18; ZDI published it as a zero-day when no fix shipped by the deadline.",
@@ -174120,7 +174732,7 @@
       "reboot_required": 0
     },
     "last_verified": "2026-08-08",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated GET or POST to /api/v1/auto_login from an off-network source returning HTTP 200 with a JSON body containing access_token and refresh_token — no credential material is presented and none is checked",
@@ -175972,7 +176584,7 @@
       "reboot_required": 0
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated POST to /goanywhere/lic/accept on the GoAnywhere administrative console (default TCP 8000/8001) carrying a Base64 `bundle` parameter — the License Response Servlet deserialization sink",
@@ -177172,7 +177784,7 @@
       "reboot_required": 5
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "sslvpnd crash entries in the event log: 'Logdesc=Application crashed ... application:sslvpnd ... Signal 11 received' — the overflow's failed-attempt signature",
@@ -177379,7 +177991,7 @@
       "reboot_required": 5
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated requests that reach the SAML SP/IdP processing path on an appliance whose ns.conf contains 'add authentication samlAction' or 'add authentication samlIdPProfile'",
@@ -180432,7 +181044,7 @@
       "reboot_required": 5
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated POST to /userportal/Controller with mode=451, or to /webconsole/Controller with mode=151, whose json parameter carries a _discriminator object supplying curvalue with shell metacharacters or backticks (e.g. ;`nc <host> 80`)",
@@ -180627,7 +181239,7 @@
       "reboot_required": 0
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "An Apex One management-console session instructing agents to perform an agent rollback to an older build outside a planned maintenance window",