@blamejs/exceptd-skills 0.21.1 → 0.21.2

package/data/cve-catalog.json

@@ -2595,7 +2595,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The vendor release note lists the reporter as Anonymous and states exploits existed in the wild, indicating discovery through in-the-wild detection of a zero-day. No AI involvement is claimed, and the disclosure predates AI-assisted vulnerability discovery becoming operational.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2020-16017 (CWE-416, CVSS 9.6) + CISA KEV (added 2021-11-03) + Google Chrome stable channel release 86.0.4240.198, reported anonymously and confirmed exploited in the wild, with the Microsoft Edge 86.0.622.69 security release note.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03. Google's stable channel release states it is aware of reports that exploits for this flaw and for CVE-2020-16013 exist in the wild; the bug was reported anonymously on 2020-11-07 and fixed four days later. Microsoft's Edge 86.0.622.69 release on 2020-11-13 also fixed both flaws and describes them as reported by the Chromium team as having an exploit in the wild. No named campaign is attributed to it in the sources read.",
@@ -3052,7 +3052,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported anonymously to Google on 2021-09-08; no reporter identity or discovery method is public. No source claims any AI involvement in discovery or weaponization.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2021-30633 (CWE-416, CVSS 9.6) + CISA KEV (added 2021-11-03) + Google Chrome desktop update advisory (Chrome 93.0.4577.82, 2021-09-13). The flaw was reported anonymously.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this on 2021-11-03 with a 2021-11-17 due date and records the ransomware field as Unknown. Google's September 13, 2021 Chrome release states it is aware that exploits for CVE-2021-30632 and CVE-2021-30633 exist in the wild, and Microsoft's Edge 93.0.961.52 release note states the Chromium team reported an exploit in the wild for CVE-2021-30633. GitHub Security Lab assesses that CVE-2021-30633 can be used to escape the sandbox once the renderer flaw CVE-2021-30632 has compromised the renderer, together giving a full remote compromise of Chrome; its author states he had no non-public information about the bugs and that his analysis may differ from how they were exploited in the wild. Google's note does not say the two were used together. Both were reported anonymously, and no source names an actor or campaign.",
@@ -5123,7 +5123,7 @@
     },
     "ai_discovered": true,
     "ai_discovery_notes": "CERT Polska (part of the NASK National Research Institute) states the RouterOS vulnerabilities were discovered by Slawomir Rozbicki using the GPT-5.5-cyber and GPT-5.6-sol models within an agent-based research environment under the OpenAI GTAC program; the models automated the laboratory and systematically searched protocol state machines, and human researchers verified every hypothesis. An independent reverse-engineering effort separately described its RouterOS diff analysis and lab reproduction as AI driven.",
-    "ai_discovery_source": "academic_ai_fuzzing",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "discovery_attribution_note": "NVD records CVE-2026-86060 as CWE-88 at CVSS 9.2; CISA added it to the KEV catalog on 2026-09-10; MikroTik's 'September 2026 vulnerability' advisory is the vendor source. CERT Polska (NASK) credits Slawomir Rozbicki with the discovery, which he made with the GPT-5.5-cyber and GPT-5.6-sol models in an agent-based research environment under the OpenAI GTAC program, and Nick Pratley with the reverse-engineering analysis.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2026-86060 to KEV on 2026-09-10 with a 2026-09-13 due date and records ransomware use as Unknown. CERT Polska reports observing attacks against internet-exposed RouterOS since at least 2 September 2026, using the MikroTrick chain to take full control of devices whose SSH service is reachable, and attributes the confirmed activity, including creation of a highly privileged 'ops' account, to source address 82.192.72.4, with 103.102.31.18 seen in further attempts. No source names an actor or a campaign, although a reverse-engineering write-up lists three domains it describes as campaign infrastructure.",
@@ -7814,7 +7814,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported on 2020-10-19 by Sergei Glazunov of Google Project Zero, who had the in-the-wild exploit sample; Project Zero notes the bug is relatively straightforward to find by manual code review and may have been found through variant analysis of an earlier FreeType issue. No source claims any AI involvement in discovery or weaponization.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2020-15999 (CWE-787, CVSS 9.6) + CISA KEV (added 2021-11-03) + Google Chrome desktop update advisory (Chrome 86.0.4240.111, 2020-10-20), the FreeType 2.10.4 release note, Mozilla advisories MFSA 2020-50, 2020-51 and 2020-52 and NetApp advisory NTAP-20240812-0001, credited to Sergei Glazunov of Google Project Zero.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to the KEV catalog on 2021-11-03 (due 2021-11-17), ransomware use recorded as Unknown. Google's release note states awareness of an in-the-wild exploit, and FreeType shipped 2.10.4 as an emergency release telling all users to update immediately. Project Zero documented it as the renderer stage of the October 2020 watering-hole operation: one exploit server delivered it to Chrome on Windows with the cng.sys kernel flaw CVE-2020-17087, and the other delivered it on Android to Chrome, paired with the sandbox escape CVE-2020-16010, and to Samsung Browser, paired with a Chromium n-day. Both Android targets were fully patched Android 10 devices. Project Zero attributes the operation to the actor from its February 2020 campaign and names no ransomware operator.",
@@ -8042,7 +8042,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported anonymously to Google on 2021-04-07; no reporter identity or discovery method is public. No source claims any AI involvement in discovery or weaponization.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Sourced from NVD CVE-2021-21206 (CWE-416, CVSS 8.8) + CISA KEV (added 2021-11-03) + Google Chrome desktop update advisory (Chrome 89.0.4389.128, 2021-04-13). The flaw was reported anonymously.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records the ransomware field as Unknown. Google's April 13, 2021 Chrome release states it is aware of reports that exploits for CVE-2021-21206 and CVE-2021-21220 exist in the wild, and Microsoft's Edge 89.0.774.77 release note states the Chromium team reported an exploit in the wild. The root-cause analysis states the exploit corrupted PartitionPage metadata to gain arbitrary read and write, then wrote to a WebAssembly RWX page to run code. No source names a campaign or actor.",
@@ -9421,7 +9421,7 @@
     },
     "ai_discovered": true,
     "ai_discovery_notes": "Horizon3, a security firm, states its autonomous vulnerability-research system initially flagged the vulnerability, and that an agent had automatically de-obfuscated Sangoma's Perl handler before the SQL injection sink in the phone-notification code was identified. Horizon3 places the work in April 2026 and gives no date for the flagging itself. Security Risk Advisors reported the same flaw independently and credits Cameron Lischke.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "discovery_attribution_note": "Compiled from NVD CVE-2026-9586 (CWE-89, CVSS 9.3) + CISA KEV (added 2026-09-02) + Sangoma Switchvox 8.4.0.2 release notes. Surfaced by Horizon3's own autonomous vulnerability-research system; independently reported by Cameron Lischke of Security Risk Advisors.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2026-9586 to KEV on 2026-09-02 with a 2026-09-05 due date and records ransomware use as Unknown. Horizon3, running internet honeypots in coordination with Defused Cyber, recorded the first valid exploitation attempt on 30 August 2026, using 176.65.148.184 as the destination of a reverse shell and following it with a process-enumeration command; Shodan shows roughly four thousand appliances on the internet, most of them in the United States. No named actor is attributed.",
@@ -16596,7 +16596,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found as in-the-wild zero-days: the flaws were disclosed through incident-response investigation by Accellion and Mandiant/FireEye after active exploitation, not by pre-disclosure research. Predates AI-assisted discovery; no AI tooling is credited in any source consulted.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-27104 (CWE-78, CVSS 3.1 base 9.8), the Accellion vendor CVE text (accellion/CVEs archive), CISA KEV (added 2021-11-03, ransomware Known), CISA advisory AA21-055A, and the Mandiant threat-intelligence report 'Accellion FTA Exploited for Data Theft and Extortion' (UNC2546/UNC2582, DEWMODE). No public proof-of-concept exploit was found; the CVEDB PoC aggregator records 'No PoCs from references' for this CVE.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2021-27104 to KEV on 2021-11-03 with a compressed 2021-11-17 due date, and records ransomware use as Known. Mandiant (FireEye) attributes the exploitation to the cluster UNC2546, which from mid-December 2020 exploited the FTA zero-days and installed the DEWMODE web shell (at /home/seos/courier/about.html and /home/httpd/html/about.html); a separate cluster, UNC2582, conducted the follow-on data-theft extortion, threatening publication on the 'CL0P^_- LEAKS' .onion site from late January 2021, with victim counts rising through February 2021. CISA/FBI documented the campaign and DEWMODE in advisory AA21-055A. This is a documented, named campaign.",
@@ -18771,7 +18771,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The S2-061 advisory credits named human researchers and the GitHub Security Lab advisory GHSL-2020-205 is a manual code-review finding on the double-evaluation pattern. Nothing in the sources retrieved indicates AI involvement in discovery.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "The Apache S2-061 advisory credits Alvaro Munoz (pwntester at github dot com) and Masato Anzai of Aeye Security Lab, inc. The Metasploit module metadata additionally credits Alvaro Munoz for the CVE-2020-17530 discovery, ka1n4t for the CVE-2020-17530 proof of concept, Matthias Kaiser for the earlier CVE-2019-0230, and Spencer McIntyre for the module itself. Alvaro Munoz's advisory is published as GHSL-2020-205 (securitylab.github.com), referenced from the Metasploit module.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2020-17530 to KEV on 2021-11-03 with a due date of 2022-05-03 — the six-month tier applied to the pre-2021 entries in that first catalog. No named campaign, no named threat actor and no incident report is public in the sources retrieved, and the KEV ransomware field reads 'Unknown'; this entry carries no attribution. What is established beyond the KEV listing is the tooling state: a shipped Nuclei template, a Metasploit module and a public PoC repository mean exploitation requires no exploit development at all, and the EPSS score of 0.95931 (99.869th percentile, 2026-08-31) reflects continued opportunistic scanning rather than a specific intrusion set.",
@@ -20502,8 +20502,8 @@
       "_ioc_source_note": "No detection rule, detection template or vendor detection guidance for this CVE was reachable. The only source verified is Apple's advisory for iOS 14.4 and iPadOS 14.4 (HT212146, served at https://support.apple.com/en-us/103123), which states the impact, states that the fix is improved locking, and credits an anonymous researcher. It records nothing an operator can match on: no log string, no file path, no process name and no network artifact. Every indicator therefore comes from the advisory and from the mechanics of the defect rather than from an observed artifact. Read them as hunting heuristics, including the kernel-panic frequency signal, the assertion that a failed voucher race panics rather than failing quietly, the sandboxed process gaining capabilities beyond its entitlements, and the voucher frames in a panic backtrace. The build-level host indicators are the only ones that can be checked directly, and the Catalina and Mojave lines need the presence of Security Update 2021-001 rather than a version string. The public exploit source for this CVE is C code for a kernel race: the repository holds voucher_leak.c, iosurface.c, their headers and an entitlements file, and no written description of the technique, so it carries nothing an operator could match on and nothing here is drawn from it. Apple names no actor, and no source reviewed attributes this CVE to a named campaign, so no actor infrastructure, file hash or command-and-control address is listed."
     },
     "ai_discovered": false,
-    "ai_discovery_notes": "Apple credits an anonymous researcher and gives no further detail, so the discovery method is not established. Nothing reviewed indicates AI involvement, and none is asserted; the source is recorded as unknown rather than inferred from the era.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_notes": "Apple credits an anonymous researcher and gives no further detail, so the discovery method is not established. Nothing reviewed indicates AI involvement, and none is asserted.",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Apple's HT212146 credits 'An anonymous researcher' for CVE-2021-1782. The anonymity is itself notable on an issue Apple flags as possibly actively exploited, but nothing in the sources reviewed identifies the reporter or the party that observed the exploitation. Synacktiv's later public exploit is analysis of the patched bug, not the discovery.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's iOS 14.4 and iPadOS 14.4 advisory (HT212146, released 2021-01-26) states for this issue that Apple is aware of a report that it may have been actively exploited, and credits an anonymous researcher. CISA KEV-listed it 2021-11-03 with a 2021-11-17 deadline and records ransomware use as 'Unknown'. Two WebKit flaws fixed in the same release, CVE-2021-1870 and CVE-2021-1871, carry the same actively-exploited wording - a remote code execution primitive and a kernel escalation shipped in one update, which is the shape of a complete chain, and neither of those CVE ids appears in this chunk. Apple attributes the activity to no named actor, and no public campaign name for this chain was located in the sources reviewed; the attribution that exists is Apple's own hedged reporting language and nothing further should be read into it.",
@@ -20626,7 +20626,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Apple credits an anonymous researcher, which establishes only that the reporter chose not to be named. Nothing in the sources retrieved indicates AI involvement in discovery.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Apple credits an anonymous researcher for CVE-2021-1870 and for its sibling CVE-2021-1871 in HT212146 (iOS 14.4 and iPadOS 14.4); both entries were updated 2021-05-28. No further attribution exists in the sources retrieved. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-284 is used for the logic failure Apple addressed 'with improved restrictions', which lets processed web content reach behaviour it should not.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's HT212146 and HT212147 state, for this CVE and for CVE-2021-1871: 'Apple is aware of a report that this issue may have been actively exploited.' Both entries were credited to an anonymous researcher and both were updated on 2021-05-28. That vendor sentence is the whole of what is established — Apple names no actor, no campaign and no targeting, and 'a report that this issue may have been actively exploited' is deliberately weaker than a confirmation of a campaign. CISA added the CVE on 2021-11-03 with a fourteen-day due date of 2021-11-17. No incident report naming this CVE is public in the sources retrieved and the KEV ransomware field reads 'Unknown'; this entry carries no attribution.",
@@ -24671,7 +24671,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Citrix disclosed the flaw in advisory CTX696604 on 2026-06-30. No AI tooling is credited in any source consulted, and no external finder is named in the material that was reachable - the Citrix support article itself did not render for retrieval, so the acknowledgement section could not be read.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-8452 (CWE-119, CVSS 4.0 base 8.8), CISA KEV (added 2026-08-26, due 2026-08-29), watchTowr Labs' 2026-08-14 root-cause and exploitation write-up, Bishop Fox's patch-verification analysis, and Help Net Security's 2026-08-27 report of Defused and Previdian exploitation telemetry. The finder credited by Citrix in CTX696604 could not be read and is therefore not asserted.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2026-8452 to KEV on 2026-08-26 with a due date of 2026-08-29 - three days - and recorded ransomware use as Unknown. The exploitation reporting that matches the listing window is: threat-intelligence firm Defused recorded the first exploitation hits on 2026-08-14, the same day watchTowr published; Previdian reported 'This morning we started seeing exploitation for CVE-2026-8452' from three unique IPs in three different countries; and the Canadian Centre for Cyber Security confirmed in-the-wild exploitation on 2026-08-17. Observed post-exploitation is opportunistic rather than targeted - PHP web shells named x.php and z.php dropped on the appliance and discovery commands id and echo run to fingerprint what responded. No actor codename, no campaign name and no ransomware family is attached to this CVE by any source consulted, and the pattern reported is untargeted internet-wide scanning, so no attribution should be inferred.",
@@ -26274,7 +26274,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered in the wild in April 2013 and reported to Microsoft by Daniel Caselden of FireEye, with iSIGHT Partners also credited in the MS13-038 acknowledgements. This predates AI-assisted vulnerability discovery entirely and no AI tooling is credited anywhere.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-1347 (CWE-416, CVSS 3.1 base 8.8), Microsoft Security Bulletin MS13-038 (published 2013-05-14, KB2847204, revision 1.1 on 2013-05-29) and Microsoft Security Advisory 2847140, CISA KEV (added 2022-03-03), Cisco's 2013-05-04 analysis of the Department of Labor watering hole, and the Rapid7 module documentation. MS13-038 credits Daniel Caselden of FireEye and iSIGHT Partners.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-03-03 with a 2022-03-24 due date and recorded ransomware use as Unknown; the exploitation itself is from 2013 and is documented in the vendor bulletin, which states that Microsoft is aware of attacks attempting to exploit this vulnerability through Internet Explorer 8 and that the issue was publicly disclosed before the patch. The named campaign is the watering-hole compromise of the United States Department of Labor website in late April 2013: pages hosting nuclear-related content were injected to load malicious content from dol.ns01.us (a changeip.org dynamic-DNS name, first sighted 2013-04-30, resolving to 96.44.136.115), with command and control at microsoftUpdate.ns1.name, also on changeip.org. Cisco's analysis records that the injected code performed reconnaissance on visitors, collecting antivirus and browser plug-in information before delivering the exploit. Attribution is explicitly unsettled in the source: CrowdStrike is quoted as not having concluded that the command and control is related to DeepPanda, so no actor should be named. Microsoft credits Daniel Caselden of FireEye and iSIGHT Partners for reporting the vulnerability.",
@@ -26510,7 +26510,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found as an in-the-wild zero-day in February 2013, years before AI-assisted vulnerability discovery was operationally available. FireEye announced the discovery on 2013-02-12; Adobe's APSA13-02 responded to active attacks rather than to a coordinated report. No AI tooling appears in any source consulted.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-0640 (CWE-787, exploited in the wild February 2013), Adobe advisory APSA13-02, CERT/CC vulnerability note VU#422807, Kaspersky's MiniDuke analysis on Securelist, and CISA KEV (added 2022-03-03). CERT/CC's note names no reporting researcher; the public discovery announcement is FireEye's of 2013-02-12.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "NVD records the flaw 'as exploited in the wild in February 2013'; Adobe published APSA13-02 as an out-of-cycle advisory in response. FireEye announced the discovery on 2013-02-12. Kaspersky's analysis ties the PDF zero-day to the campaign it first called ItaDuke - named for Duqu similarities and Italian comments in the shellcode - and then MiniDuke, counting 59 unique victims across 23 countries including Belgium, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Portugal, Romania, Russia, Spain, Turkey, Ukraine, the United Kingdom and the United States, with the operators still active through at least 2013-02-20. The payload was a roughly 20 KB downloader carrying an assembler-written backdoor whose C2 sat in Panama and Turkey and which used Twitter and Google Search as fallback channels by resolving encrypted strings from tweets and search results. Kaspersky attributes no state sponsor; no ransomware family is named by any source consulted, and CISA records ransomware use as Unknown. CISA added the CVE to KEV on 2022-03-03 with a 2022-03-24 due date - nine years after the exploitation it records.",
@@ -27972,7 +27972,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Adobe in security bulletin APSB10-07 in February 2010. The bulletin's acknowledgement section could not be retrieved, so no finder is named here; no AI tooling is credited in any source consulted, and the date predates AI-assisted vulnerability discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2010-0188 (no CWE assigned, CVSS 3.1 base 7.8), CISA KEV (added 2022-03-03, ransomware Known), Adobe bulletin APSB10-07, Red Hat advisory RHSA-2010:0114 and Secunia advisory SA38639 as referenced by NVD, the Exploit-DB entries 11787 and 16670, and the antivirus detection families published by Microsoft, F-Secure and Kaspersky. The Adobe bulletin page did not render for retrieval, so no reporter credit is asserted. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-680 is used for the integer-overflow-to-buffer-overflow the vector describes — decoding a malformed TIFF embedded in a PDF overflows a buffer in the bundled libTIFF, which the public exploits characterise as an integer overflow reached from PDF image parsing.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-03-03 with a 2022-03-24 due date and recorded ransomware use as Known - CISA names no family, and none should be inferred. The documented in-the-wild use is commodity rather than targeted: malicious PDFs exploiting CVE-2010-0188 were a standard payload of the Blackhole exploit kit, delivered by drive-by download from compromised sites, SEO poisoning and malicious spam links. Multiple antivirus vendors carry dedicated detection families for the exploit itself - Microsoft's Exploit:Win32/CVE-2010-0188.A, F-Secure's Exploit:W32/CVE-2010-0188.B and .C, and Kaspersky's Exploit.Win32.CVE-2010-0188 - which is the clearest published evidence of sustained volume. No named campaign and no actor attribution is carried by the sources consulted.",
@@ -28960,7 +28960,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Microsoft's July 2017 security update acknowledgements credit 'Haifei Li of the McAfee Security Team' for this vulnerability. That is vendor-adjacent security research rather than an independent report or a bug-bounty submission. No AI involvement is claimed and none is plausible for a 2017 disclosure.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from the Microsoft July 2017 Security Updates CVRF (release 2017-07-11, severity Important, acknowledgement to Haifei Li of the McAfee Security Team), the MSRC advisory for CVE-2017-8570, NVD, the CISA KEV entry of 2022-02-25, Exploit-DB 44263 by Rich Warren, the rxwx/CVE-2017-8570 repository, and Zscaler's reporting on Lokibot malspam. NVD notes this CVE is distinct from CVE-2017-0243, and it is frequently confused with CVE-2017-0199, a different moniker flaw fixed three months earlier. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-829 is used for the inclusion of functionality from an untrusted control sphere the vector describes — Office resolves a document-supplied composite moniker that binds a scriptlet moniker and executes the .sct it names, without the checks that constrain what an embedded object may be.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-02-25 with a 2022-08-25 due date and records the ransomware association as Unknown. Exploitation is commodity rather than a single named campaign, and it long outlived the July 2017 fix: Zscaler documented malspam campaigns delivering Lokibot through malicious RTF documents chaining CVE-2017-8570 with CVE-2018-0802, Trend Micro published a customer advisory on the CVE downloading high-profile malware families, and Juniper ships a dedicated IPS signature, HTTP:STC:MS-CVE-2017-8570-RCE. Microsoft's own vulnerability record still carries Exploited:No from the July 2017 assessment, which is the state at release and not a current judgement — the KEV listing supersedes it. No named threat-actor group is attributed to this CVE in the sources reviewed, and none should be inferred from the malware families it delivered.",
@@ -29880,7 +29880,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found in the wild by Kaspersky's sandbox detection in late April 2018, with 360 independently analysing it per 0patch's credit line. Sandbox detonation is automated triage of live samples, not AI-assisted vulnerability discovery, and no source consulted credits any AI or ML tooling with finding the flaw.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2018-8174 (CWE-787), the MSRC advisory, Kaspersky's Securelist analysis by Boris Larin (2018-07-03, discovery late April 2018), the 0patch micropatch write-up of 2018-05-15 crediting Kaspersky and 360, Exploit-DB 44741, and CISA KEV (added 2022-02-15, ransomware use Known).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Kaspersky detected the exploit in the wild in late April 2018 through its sandbox and reported it to Microsoft; Boris Larin published the technical analysis on Securelist on 2018-07-03. 0patch's write-up credits both Kaspersky and 360 with in-the-wild discovery and analysis, so two vendors independently found it in live attacks. CISA added the CVE to KEV on 2022-02-15 with a 2022-08-15 due date and records ransomware use as **Known** - the only entry in this chunk that does - but no ransomware family is named by CISA or by any source consulted, and none is asserted here. A public repository named orf53975/Rig-Exploit-for-CVE-2018-8174 redistributes exploit-kit code under the Rig name; that establishes the existence of the repository, not an independently confirmed Rig campaign, and it is recorded on that basis. Kaspersky's technical analysis names no threat actor or campaign.",
@@ -30585,8 +30585,8 @@
       ]
     },
     "ai_discovered": false,
-    "ai_discovery_notes": "Apple credits the report to 'an anonymous researcher' in all three advisories and gives no affiliation, so the discovery route cannot be characterised — the source is recorded as unknown rather than assumed human. Project Zero's analysis is post-patch root-cause work by Maddie Stone and is not the discovery. No AI-assisted discovery is claimed by any party, and no evidence for one exists either way.",
-    "ai_discovery_source": "unknown",
+    "ai_discovery_notes": "Apple credits the report to 'an anonymous researcher' in all three advisories and gives no affiliation, so the reporter is outside Apple but unnamed, and the discovery route is not described. Project Zero's analysis is post-patch root-cause work by Maddie Stone and is not the discovery. No AI-assisted discovery is claimed by any party, and no evidence for one exists either way.",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from Apple's advisories HT213091 (Safari 15.3), HT213092 (macOS Monterey 12.2.1) and HT213093 (iOS/iPadOS 15.3.1), all dated 2022-02-10, the Google Project Zero 0-days-in-the-wild root-cause analysis for CVE-2022-22620, the CISA KEV entry of 2022-02-11, and the springsec/CVE-2022-22620 repository. ai_discovery_source is set to unknown rather than human_researcher because Apple's 'an anonymous researcher' credit does not establish the route.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's advisories for iOS 15.3.1 and iPadOS 15.3.1, macOS Monterey 12.2.1 and Safari 15.3, all released 2022-02-10, each carry the sentence 'Apple is aware of a report that this issue may have been actively exploited' — Apple's standard formulation, which asserts a report rather than a confirmed campaign. CISA added the CVE to KEV the following day, 2022-02-11, with a 2022-02-25 due date and ransomware association Unknown. No named campaign, threat actor or victim set is public. Apple credits 'an anonymous researcher' and names no reporting vendor, so there is not even an attribution chain to reason from; Project Zero states it had no access to the exploit sample, which is why its 2022 write-up analyses the patch and the 2016 regression rather than the operator. Nothing in the reviewed sources supports naming a mercenary-spyware vendor or a state operator for this CVE, and none should be inferred from the year or the platform. EPSS is 0.16214 at the 96.8th percentile on 2026-08-28.",
@@ -30822,7 +30822,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed in March 2020 through a documentation-leak sequence around the March 2020 Patch Tuesday rather than through an AI-assisted research programme; Microsoft's response was advisory ADV200005 on 2020-03-10 followed by the out-of-band fix KB4551762 on 2020-03-12. No AI tooling is credited in Microsoft's advisory or in the subsequent vendor analyses.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2020-0796 (CWE-119, CVSS 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), CISA KEV (added 2022-02-10, due 2022-08-10, ransomware Known), Microsoft's MSRC record for CVE-2020-0796 and advisory ADV200005, and the public exploit record on Exploit-DB (48267, 48537) and Rapid7's Metasploit modules.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2022-02-10 with a 2022-08-10 due date, and records knownRansomwareCampaignUse as Known. That ransomware flag is CISA's own determination and is the sole source for it in this record: no primary vendor or government report naming a specific ransomware family or operator for CVE-2020-0796 was found at curation time, and this entry deliberately names none. Microsoft published advisory ADV200005 on 2020-03-10 after the vulnerability was disclosed ahead of a patch, and shipped the fix as KB4551762 on 2020-03-12. Public reporting through 2020 described broad opportunistic scanning and malware families incorporating the vulnerability, with declining sample volume as the affected builds were patched or retired.",
@@ -31263,7 +31263,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Oracle in the Critical Patch Update advisory of October 2017. Oracle's credit-statements page was not retrieved, so no finder is named here. The date precedes AI-assisted vulnerability discovery and no AI tooling is credited in any source consulted.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-10271 (CWE-306, CVSS 3.1 base 7.5, Oracle-supplied vector), the Oracle Critical Patch Update advisory of October 2017, CISA KEV (added 2022-02-10, ransomware Known), the vulhub reproduction environment, the projectdiscovery Nuclei template, and Exploit-DB 43924. No reporter is named because Oracle's acknowledgement page was not read.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-02-10 with a 2022-08-10 due date - a six-month window rather than the usual fortnight - and recorded ransomware use as Known; CISA names no family and none should be inferred. The documented in-the-wild use is mass, opportunistic and financially motivated rather than targeted: from late 2017 into 2018, operators scanned for exposed /wls-wsat/ endpoints and installed cryptocurrency mining software, with Monero miners on unpatched WebLogic servers the pattern reported by multiple vendors. Publication of a proof of concept on 2017-12-23 marks the start of the volume. No named campaign and no actor codename is carried by the sources consulted.",
@@ -31494,7 +31494,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found by FireEye as an in-the-wild zero-day during 2017 threat research, after Microsoft's April 2017 disabling of EPS prompted continued scrutiny of the filter. No AI or ML tooling is credited in the report, and the discovery method described is analysis of live attack samples.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-0262 (no CWE assigned), the MSRC advisory for this CVE, FireEye's EPS-processing zero-days report of 2017-05-09 (APT28 attribution, GAMEFISH payload, CVE-2017-0263 chaining, lure hash and C2), Microsoft security advisory ADV170005, and CISA KEV (added 2022-02-10). CWE assigned editorially: NVD records no weakness for this CVE, so CWE-843 is used for the type confusion the vector describes — the EPS interpreter accesses a forged procedure object as an incompatible type, which the `forall` operator turns into control of the operand stack.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "FireEye's report of 2017-05-09 attributes CVE-2017-0262 to APT28, a Russian cyber-espionage group, targeting European diplomatic and military entities, and states it delivered the GAMEFISH payload. The named lure is Trump's_Attack_on_Syria_English.docx, MD5 f8e92d8b5488ea76c40601c8f1a08790, with C2 at wmdmediacodecs.com; FireEye records the EPS bug as chained with CVE-2017-0263 for privilege escalation and sandbox escape. FireEye distinguishes this from the contemporaneous CVE-2017-0261, a use-after-free on the `restore` operand used by Turla and by an unnamed financially motivated group with SHIRIME and NETWIRE payloads - the two are separate flaws and should not be conflated. FireEye also records that it detected this second EPS vulnerability after Microsoft disabled EPS in the April 2017 Patch Tuesday. CISA added the CVE to KEV on 2022-02-10 with a 2022-08-10 due date and records ransomware use as Unknown; no ransomware family is named.",
@@ -32462,7 +32462,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed in Microsoft's January 2022 update cycle. No AI tooling is credited in Microsoft's advisory, in Unit 42's analysis or in Google Project Zero's root-cause analysis, and the public exploits are hand-written data-only win32k code building on the CVE-2021-1732 technique.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2022-21882 (CWE-787, CVSS 7.8 AV:L/AC:L/PR:L/UI:N), CISA KEV (added 2022-02-04, due 2022-02-18, ransomware Known), Microsoft's MSRC record for CVE-2022-21882, Palo Alto Unit 42's win32k exploitation analysis of CVE-2022-21882 and CVE-2021-1732, Google Project Zero's 0days-in-the-wild root-cause analysis, and Rapid7's Metasploit module exploit/windows/local/cve_2022_21882_win32k.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft shipped the fix in the January 2022 update cycle (2022-01-11). CISA added the CVE to KEV on 2022-02-04 with a 2022-02-18 due date — fourteen days — and records knownRansomwareCampaignUse as Known. Google Project Zero includes CVE-2022-21882 in its 0-days-in-the-wild root-cause-analysis collection and states the analysts had the exploit sample, which is the strongest public evidence of real-world use. Public reporting in late January 2022 (BleepingComputer, SecurityAffairs) described social-media reports of in-the-wild exploitation alongside multiple public exploit releases. No named campaign or threat actor is attributed to CVE-2022-21882 in Microsoft's advisory or in Project Zero's analysis; the BITTER APT name that appears in the Metasploit module's author field is a research-credit line inherited from the CVE-2021-1732 work and is not an attribution of this CVE's exploitation. No specific ransomware family is named in any of the sources checked — the ransomware flag is CISA's determination.",
@@ -33141,7 +33141,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by FireEye as an in-the-wild zero-day and disclosed on 2014-04-26. No AI or ML tooling is credited in CERT/CC's note or in any source consulted; the discovery method described is analysis of live targeted attacks.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-1776 (CWE-416, exploited in the wild April 2014, including Microsoft's VGX.DLL clarification), CERT/CC vulnerability note VU#222929, Microsoft security advisory 2963983 and bulletin MS14-021, and CISA KEV (added 2022-01-28). FireEye is the disclosing party per CERT/CC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "NVD records the flaw 'as exploited in the wild in April 2014'. FireEye publicly disclosed it on 2014-04-26 and CERT/CC's VU#222929 references the campaign as Operation Clandestine Fox, noting it targeted even legacy Windows XP systems - which is the detail that mattered publicly, because XP had reached end of support on 2014-04-08 and Microsoft nonetheless shipped it an update. Microsoft published security advisory 2963983 with interim guidance and then bulletin MS14-021 out of band. CISA added the CVE to KEV on 2022-01-28 with a 2022-07-28 due date and records ransomware use as Unknown; no ransomware family and no threat-actor name beyond the campaign designation appears in the sources consulted, and no state attribution is asserted here.",
@@ -33861,7 +33861,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Found by Jonathan Bar Or, a Microsoft security researcher, during threat-hunting on Log4j exploitation activity rather than through code review, fuzzing or a bounty submission. That is vendor security research, at a vendor other than the affected one. No AI-assisted discovery is claimed by Microsoft or SolarWinds.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from the SolarWinds trust-centre advisory for CVE-2021-35247 and the Serv-U 15.3 release documentation, NVD, the CISA KEV entry of 2022-01-21, and Microsoft's finding as reported by Help Net Security including Jonathan Bar Or's own description of the behaviour. The specific request shape used against affected instances was never published by Microsoft or SolarWinds, so no exploitation payload is recorded here.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-21 with a 2022-02-04 due date and records the ransomware association as Unknown. The discovery and the exploitation are the same event: Microsoft security researcher Jonathan Bar Or was analysing Log4j exploitation activity in December 2021 and noticed attacks coming from serv-u.exe, which led to the finding that Serv-U would build an LDAP query from unsanitized input — so the attackers reached the flaw before the vendor did. No named campaign, threat actor group or victim set is public, and the actors are described only as opportunistic Log4j exploitation traffic. SolarWinds' own position is that no downstream effect was detected because the LDAP servers ignored the improper characters, and that the Log4j attempts against Serv-U failed because the product does not use Log4j; neither statement contradicts the KEV listing, which is about the input-validation flaw being exercised in the wild rather than about the Log4j payloads succeeding. EPSS is 0.03453 at the 88th percentile on 2026-08-28 — a moderate rank on a low absolute score, consistent with a flaw that is being probed but has no published exploit.",
@@ -34741,7 +34741,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The advisory GHSA-2m8v-572m-ff2v was published on 2021-02-14 by sebhildebrandt, the package maintainer, and the page retrieved credits no external reporter or researcher. No AI or ML tooling is named in the advisory, the NVD record, or the fix commit, and the defect class - an array bypassing a string sanitiser - is a code-reading result rather than a fuzzing crash.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-21315 (CWE-78, published 2021-02-16), the vendor advisory GHSA-2m8v-572m-ff2v (published 2021-02-14 by sebhildebrandt, no external reporter credited), the fix commit 07daa05fb06f24f96297abaa30c2ace8bfd8b525, the NetApp advisory ntap-20210312-0007, CISA KEV (added 2022-01-18), and the projectdiscovery Nuclei template http/cves/2021/CVE-2021-21315.yaml.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-18 with a 2022-02-01 due date - fourteen days - and records ransomware use as Unknown. CISA's own catalogue text is the only exploitation narrative located: 'an attacker can send a malicious payload that will exploit the name parameter'. No named campaign, threat actor, malware family or vendor incident report connecting exploitation to this CVE was found in the sources consulted, and none should be inferred from the KEV listing. What can be stated about the exploitation environment is that tooling was widely available well before the listing: the ForbiddenProgrammer PoC repository was created 2021-03-01, roughly two weeks after the 2021-02-16 NVD publication, and a Nuclei template ships in the default template set, so opportunistic internet-wide scanning for the getServices route is the expected background activity.",
@@ -35418,7 +35418,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "VMSA-2021-0020 states that the vulnerabilities it covers 'were privately reported to VMware' and carries per-CVE acknowledgements; the acknowledgement text for CVE-2021-22017 was not recoverable from the advisory content reviewed, so no individual credit is asserted here. No AI-assisted discovery is claimed by VMware or by any reporter.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from VMware advisory VMSA-2021-0020.2 (issued 2021-09-21, updated 2025-12-05) including its full response matrix, NVD, the CISA KEV entry of 2022-01-10, the projectdiscovery/nuclei-templates entry http/cves/2021/CVE-2021-22017.yaml, and GreyNoise's reporting on the CVE-2021-22005 chain as covered by SecurityWeek. The reporter for this specific CVE could not be sourced from the advisory content reviewed and is therefore left unstated rather than guessed. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-647 is used for the authorization decision taken on a non-canonical URL path that the vector describes — rhttpproxy decides from the request path which internal endpoint may be reached, and normalises `..;/` segments differently from the backend it forwards to.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-01-24 due date and records the ransomware association as Unknown. The exploitation reporting is about the chain rather than this CVE alone: GreyNoise observed attacks chaining CVE-2021-22005, the critical vCenter arbitrary-file-upload flaw from the same VMSA-2021-0020 advisory, with CVE-2021-22017 as the proxy bypass that reaches its endpoint — the reachability that VMware's own text describes as 'internal endpoints being accessed'. No named campaign, threat actor group or victim count is public for this CVE. Note the divergence in how badly it was scored: NVD assigns 5.3 with confidentiality-low only, while VMware assigns 7.3 with low impact across confidentiality, integrity and availability and rates it Important — the vendor's higher score is the better guide to why it was listed. EPSS is 0.49177 at the 98.8th percentile on 2026-08-28, which is far above what the base score alone would suggest and is consistent with a flaw whose value is compositional.",
@@ -42171,7 +42171,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco published the defect in its own September 2017 bundled IOS advisory set under bug ID CSCuz47179 and credits no outside reporter, which places discovery inside Cisco's engineering and PSIRT process. Neither the advisory nor NVD's reference set indicates automated or AI-assisted discovery, and no research arm - AI-branded or otherwise - is named.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12235 (CWE-20, CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-profinet (Cisco bug ID CSCuz47179). Cisco scores the same defect 8.6 on its own advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-profinet states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' That is vendor-documented activity carried in a revision of the 2017 advisory, contemporaneous with the CISA KEV enrollment on 2022-03-03. Cisco characterises it as attempted exploitation and names no threat actor, campaign, victim set or geography. CISA records no known ransomware use.",
@@ -42274,7 +42274,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The defect appears in Cisco's own September 2017 bundled IOS advisory under bug ID CSCvc43709 with no external reporter credited, placing discovery inside Cisco's engineering and PSIRT process. Nothing in the advisory or in NVD's references points to fuzzing infrastructure, automated analysis or AI assistance of any kind.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12234 (CWE-20, CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-cip (Cisco bug ID CSCvc43709). The advisory covers a second CIP defect, CVE-2017-12233, under bug ID CSCuz95334.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-cip states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' Note the scope of that sentence before relying on it: the advisory covers two distinct CIP defects - CVE-2017-12234 under Cisco bug ID CSCvc43709 and CVE-2017-12233 under CSCuz95334 - and the exploitation statement is written in the singular without being broken out per bug ID, so it establishes vendor-observed activity against the CIP surface described by this advisory rather than against one bug ID specifically. The observation is contemporaneous with the KEV enrollment on 2022-03-03. No actor, campaign or victim set is named, and CISA records no known ransomware use.",
@@ -42377,7 +42377,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco carries the defect under its own bug ID CSCuz95334 in a bundled advisory with no external credit, which places the finding inside Cisco's engineering and PSIRT process. No fuzzing harness, automated analysis pipeline or AI-assisted tooling is named by Cisco or in NVD's reference set, and no research group with 'AI' in its brand name appears in the record.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12233 (CWE-20, CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-cip (Cisco bug ID CSCuz95334). The same advisory carries CVE-2017-12234 under bug ID CSCvc43709 as a separate defect.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's cisco-sa-20170927-cip advisory records that 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' Read the attribution carefully before scoping an investigation from it: that advisory covers CVE-2017-12233 (CSCuz95334) and CVE-2017-12234 (CSCvc43709) together and the sentence is not broken out by bug ID, so what Cisco documents is observed activity against the CIP surface the advisory describes, not a per-defect confirmation. The observation lands alongside the KEV enrollment on 2022-03-03. Cisco names no actor and no victim set; CISA records no known ransomware use.",
@@ -42480,7 +42480,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco published the defect under its own bug ID CSCvc03809 in the September 2017 bundled IOS advisory set with no external reporter credited, which places it in Cisco's engineering and PSIRT process. An internal-only protocol between a router and its own service blades is not a surface an outside researcher typically reaches, which is consistent with vendor-side discovery. Nothing in the advisory or NVD's references names automated analysis or AI assistance.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12232 (CVSS 6.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-rbip-dos (Cisco bug ID CSCvc03809). CWE assigned editorially: NVD's only weakness assignment is CWE-399, which MITRE renders as 'CWE CATEGORY: Resource Management Errors' and marks PROHIBITED for vulnerability mapping on the grounds that 'This entry is a Category', so CWE-20 is used here for misclassification of a frame on the internal blade protocol.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-rbip-dos states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' This advisory covers only CVE-2017-12232, so unlike a bundled multi-CVE advisory the statement attaches unambiguously to this defect. The activity is vendor-documented and concurrent with the KEV enrollment on 2022-03-03; Cisco characterises it as attempted exploitation and identifies no actor, campaign, sector or geography. CISA records no known ransomware use. Note what adjacency implies for any resulting investigation: an attempt against this defect was made by something already inside a segment attached to the router.",
@@ -42583,7 +42583,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco tracks the defect under its own bug ID CSCvc57217 in the September 2017 bundled IOS advisory set and credits no outside reporter, placing the finding inside Cisco's engineering and PSIRT process. Neither the advisory nor NVD's reference set names a fuzzing harness, automated analysis or AI-assisted tooling, and no research group with 'AI' in its name is involved.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-12231 (CVSS 7.5) + CISA KEV (added 2022-03-03, due 2022-03-24, ransomware: none known) + Cisco advisory cisco-sa-20170927-nat (Cisco bug ID CSCvc57217). CWE assigned editorially: NVD's only weakness assignment is CWE-399, a MITRE Category — its page renders 'CWE CATEGORY: Resource Management Errors' and marks vulnerability-mapping usage PROHIBITED because 'This entry is a Category' — so CWE-20 is used here for improper translation of H.323 RAS messages by the NAT application layer gateway.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Cisco's advisory cisco-sa-20170927-nat states: 'In March 2022, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild.' Cisco's own page confirms that the advisory references only CVE-2017-12231, so the statement attaches to this defect alone rather than to a bundle. The activity is vendor-documented and contemporaneous with the CISA KEV enrollment on 2022-03-03. Cisco names no actor, campaign or victim set and describes the activity as attempted rather than successful; CISA records no known ransomware use.",
@@ -59125,7 +59125,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The bulletin records the flaw as not publicly disclosed but exploited in the wild, indicating Microsoft identified the in-the-wild activity itself; discovery was human vendor research, with no AI-assisted analysis claimed.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2017-0149 (CWE-787, CVSS 8.8) + CISA KEV (added 2022-05-24, ransomware: Unknown) + Microsoft advisory MS17-006, which records Exploited: Yes / Publicly disclosed: No.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft's MS17-006 (2017-03-14) marks CVE-2017-0149 as Exploited: Yes at release. CISA added it to KEV on 2022-05-24 (due 2022-06-14); KEV ransomware use Unknown.",
@@ -63857,9 +63857,9 @@
       "_ioc_source_note": "The vulnerable routine (IOMFB::TableCompensator::BilerpGainTable::new_from_data), the AppleCLCD external method 78 reachable from the app sandbox, and the 'element modified after free' panic with attacker-controlled 0x4141414141414141 data are read from Saar Amar's published analysis at https://saaramar.github.io/IOMFB_integer_overflow_poc/ and the accompanying code at https://github.com/saaramar/IOMFB_integer_overflow_poc; that write-up records its testing on an iPhone X at iOS 14.7.1 (18G82), an iPhone 11 Pro at 14.7.1 and 15.0 and an iPhone 11 Pro Max at 15.0, and names no silicon generation, so the panic indicator is stated for those builds rather than for a chip list. The fixed build numbers are from the NVD description of CVE-2021-30883 and Apple's advisory set (HT212846 and companions). No network or file signature is asserted: Apple published no indicators for the in-the-wild report, and inventing one for an on-device kernel primitive would be fabrication."
     },
     "ai_discovered": false,
-    "ai_discovery_notes": "Apple's advisory for iOS and iPadOS 15.0.2 ends the IOMobileFrameBuffer entry with 'CVE-2021-30883: an anonymous researcher' — so a finder is credited but is unnamed, and nothing published says how the issue reached Apple or what relationship it has to the exploitation report in the same entry. That unnamed credit is why the discovery route is recorded as unknown rather than assigned. Saar Amar's contribution came after the patch, by diffing Apple's fix, which is post-disclosure analysis rather than discovery. No AI-assisted discovery or triage is claimed anywhere; the published analysis is manual reverse engineering of the patched binary.",
-    "ai_discovery_source": "unknown",
-    "discovery_attribution_note": "Curated from NVD CVE-2021-30883 (CWE-787, CVSS 7.8) + CISA KEV (added 2022-05-23) + Apple advisories HT212846, HT212868, HT212869, HT212872, HT212874 and HT212876; mechanism confirmed against Saar Amar's post-patch bindiff and PoC. Apple credits 'an anonymous researcher' for the issue, so the finder is unnamed and the discovery route is recorded as unknown.",
+    "ai_discovery_notes": "Apple's advisory for iOS and iPadOS 15.0.2 ends the IOMobileFrameBuffer entry with 'CVE-2021-30883: an anonymous researcher' — so a finder is credited but is unnamed, and nothing published says how the issue reached Apple or what relationship it has to the exploitation report in the same entry. Saar Amar's contribution came after the patch, by diffing Apple's fix, which is post-disclosure analysis rather than discovery. No AI-assisted discovery or triage is claimed anywhere; the published analysis is manual reverse engineering of the patched binary.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Curated from NVD CVE-2021-30883 (CWE-787, CVSS 7.8) + CISA KEV (added 2022-05-23) + Apple advisories HT212846, HT212868, HT212869, HT212872, HT212874 and HT212876; mechanism confirmed against Saar Amar's post-patch bindiff and PoC. Apple credits 'an anonymous researcher' for the issue, so the finder is outside Apple but unnamed.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple's own advisory language is the evidence: 'Apple is aware of a report that this issue may have been actively exploited', published alongside iOS 15.0.2 on 2021-10-11 across HT212846 and the companion notes for macOS Monterey 12.0.1, iOS 14.8.1, tvOS 15.1, watchOS 8.1 and macOS Big Sur 11.6.1. CISA added the CVE to KEV on 2022-05-23 with a 2022-06-13 due date and the ransomware field Unknown. Apple credits the issue to 'an anonymous researcher' and names no actor, publishes no indicators and says nothing about who filed the exploitation report, and no named-actor attribution from a threat-intel vendor was resolvable — so what an operator can say is that a kernel escalation reachable from the app sandbox was in someone's chain in autumn 2021, and nothing more specific.",
     "attack_refs": [
@@ -76818,7 +76818,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by SAP in Security Note 3084487 as part of the August 2021 SAP Security Patch Day; the finding traces to SAP's own product security handling rather than an outside disclosure that is publicly attributed. No AI-assisted discovery is claimed or evidenced.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-38163 (CWE-22, CVSS 8.8; SAP self-scored 9.9) + CISA KEV (added 2022-06-09) + SAP Security Note 3084487. Public exploit code: purpleteam-ru and core1impact GitHub repositories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added CVE-2021-38163 to KEV on 2022-06-09 (due 2022-06-30), which is CISA's assertion of confirmed in-the-wild exploitation. KEV records the ransomware campaign use as Unknown. SAP-focused attacker interest in unrestricted-upload-to-RCE on internet-exposed NetWeaver portals is long-standing.",
@@ -78799,7 +78799,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Check Point (advisory sk185169) after in-the-wild exploitation was observed. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-16232 (CWE-287, CVSS 9.1) + CISA KEV (added 2026-07-22) + Check Point advisory sk185169.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Check Point confirmed active exploitation affecting a small number of customers at disclosure on 22 July 2026; CISA added it to KEV the same day with a three-day remediation due date (2026-07-25). Attackers reaching an internet-exposed Management Server without Trusted Clients restrictions can obtain admin tokens and rewrite firewall security policy, making it a management-plane takeover primitive.",
@@ -80691,7 +80691,7 @@
     "poc_available": false,
     "ai_discovered": false,
     "ai_discovery_notes": "Apple addressed the issue via a Rapid Security Response after learning of a report of active exploitation. The advisory does not credit external attribution or any AI tooling.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-37450 (CVSS 8.8) + CISA KEV (added 2023-07-13) + Apple vendor advisories (HT213826/HT213841/HT213843/HT213846/HT213848).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple stated it was aware of a report that this WebKit issue may have been actively exploited, and shipped it as an out-of-band Rapid Security Response; CISA added it to KEV on 2023-07-13. Exploitation requires luring a target to attacker-controlled web content (UI:R), consistent with targeted mobile-device attacks rather than mass exploitation. No detailed public PoC or technical writeup was released.",
@@ -82054,7 +82054,7 @@
     "poc_available": false,
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Samsung in the SMR Mar-2021 Release 1 security maintenance release; addressed through Samsung's mobile security process. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-25371 (CWE-912, CVSS 6.7) + CISA KEV (added 2023-06-29) + Samsung Mobile security advisory (security.samsungmobile.com).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA lists it as known-exploited (KEV added 2023-06-29). It is one of a cluster of Samsung DSP/display driver flaws fixed in the March 2021 SMR that were abused as privilege-escalation primitives in a commercial-surveillance Android exploit chain against Exynos devices; note that the publicly analysed Project Zero chain (CVE-2021-25337/25369/25370) documents sibling bugs from the same release rather than a standalone public exploit for 25371 specifically.",
@@ -89530,7 +89530,7 @@
     "poc_description": "No public standalone PoC identified. Mandiant documented the China-nexus group UNC3886 using the crafted-CLI-command path traversal to write files to FortiGate firmware for implant persistence, but exploitation required existing super-admin access and no drop-in exploit is public.",
     "ai_discovered": false,
     "ai_discovery_notes": "Surfaced through Fortinet/Mandiant incident-response investigation of UNC3886 intrusions. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-41328 (CWE-22, CVSS 7.1) + CISA KEV (added 2023-03-14) + Fortinet advisory FG-IR-22-369.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Confirmed exploited in highly targeted attacks by the China-nexus actor UNC3886, which used the path traversal to write files to FortiGate devices and maintain persistence (THINCRUST/CASTLETAP implants) with super-admin privileges. KEV-listed 2023-03-14; exploitation was espionage, not ransomware.",
@@ -89758,7 +89758,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Stephen Fewer of Rapid7. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-27198 (CWE-288, CVSS 9.8) + CISA KEV (added 2024-03-07) + JetBrains security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited within days of the March 2024 Rapid7 disclosure; CISA KEV flags known ransomware use. Attackers chained the bypass to create admin accounts and upload malicious plugins for RCE on internet-facing CI/CD servers.",
@@ -89849,7 +89849,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Attributed to an anonymous reporter via Apple's coordinated process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23225 (CWE-787, CVSS 7.8) + CISA KEV (added 2024-03-06) + Apple security advisories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple acknowledged a report of active exploitation. Used as the kernel-protection-bypass stage of a targeted exploit chain: an attacker who already holds arbitrary kernel read/write defeats memory-protection mitigations to gain reliable kernel control.",
@@ -89946,7 +89946,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Attributed to an anonymous reporter via Apple's coordinated process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23296 (CWE-787, CVSS 7.8) + CISA KEV (added 2024-03-06) + Apple security advisories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple acknowledged a report of active exploitation. Affects the RTKit real-time OS; used as a kernel-protection-bypass stage for an attacker already holding arbitrary kernel read/write, consistent with a targeted exploit chain.",
@@ -90044,7 +90044,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Android's security process (bug A-251586912). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-21237 (CWE-200, CVSS 5.5) + CISA KEV (added 2024-03-05) + Android Pixel bulletin 2023-06-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV for the Android Pixel Framework component. A locally-installed malicious app can hide its foreground-service notification, concealing background activity (e.g. surveillance) and enabling local information disclosure without user awareness.",
@@ -90137,7 +90137,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by NCC Group. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-36380 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-03-05) + NCC Group technical advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in March 2024 for in-the-wild exploitation; EPSS ~0.98. Unauthenticated attackers inject shell metacharacters to run commands as root, enabling DoS, botnet enrollment, or persistence on the network device.",
@@ -90229,7 +90229,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Jan Vojtesek of Avast, who observed Lazarus in-the-wild use. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21338 (CWE-822, CVSS 7.8) + CISA KEV (added 2024-03-04) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by the Lazarus Group (DPRK) as an admin-to-kernel primitive to install the FudModule rootkit and disable EDR; CISA KEV flags known ransomware association. Abuses an exposed IOCTL in appid.sys (the AppLocker driver) to achieve a read/write primitive.",
@@ -90321,7 +90321,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft via coordinated disclosure (Luca Ginex / researchers). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29360 (CWE-822, CVSS 8.4) + CISA KEV (added 2024-02-29) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV for in-the-wild exploitation. The Microsoft Streaming Service Proxy driver (mskssrv.sys) untrusted-pointer dereference lets a local attacker escalate to SYSTEM; public exploits make it a reliable post-compromise LPE.",
@@ -90413,7 +90413,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Cisco via its PSIRT process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-3259 (CWE-200, CVSS 7.5) + CISA KEV (added 2024-02-15) + Cisco Security Advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Leveraged by the Akira ransomware group to extract credentials from internet-facing Cisco ASA/FTD AnyConnect/WebVPN appliances; CISA KEV flags known ransomware use. A crafted GET request to the web services interface returns device memory that can contain cleartext usernames and passwords, seeding initial access.",
@@ -90505,7 +90505,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Addressed by Microsoft enabling Extended Protection by default in Exchange CU14. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21410 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-02-15) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing Exchange Servers; CISA KEV confirms in-the-wild use. An attacker coerces/relays a victim's NTLM credentials to Exchange Web Services, impersonating the victim and escalating privileges when Extended Protection is not enforced.",
@@ -90600,7 +90600,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Peter Girnus and researchers at Trend Micro ZDI (Water Hydra tracking). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21412 (CWE-693, CVSS 8.1) + CISA KEV (added 2024-02-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by the Water Hydra (DarkCasino) actor and in DarkGate campaigns to bypass SmartScreen/Mark-of-the-Web and deliver malware; CISA KEV flags known ransomware association. A crafted internet shortcut chains to a second shortcut on a network share so the payload runs without a SmartScreen warning.",
@@ -90692,7 +90692,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by security researchers (MSRC-credited); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21351 (CWE-94, CVSS 7.6) + CISA KEV (added 2024-02-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day in February 2024; crafted internet-shortcut files defeated Mark-of-the-Web so SmartScreen skipped its reputation check, delivering follow-on malware. Adjacent to the Water Hydra / DarkMe campaign that abused the sibling SmartScreen bypass CVE-2024-21412. KEV ransomware use unconfirmed.",
@@ -90787,7 +90787,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fix and disclosure via the Roundcube project; exploitation documented by ESET. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-43770 (CWE-79, CVSS 6.1) + CISA KEV (added 2024-02-12) + Roundcube 1.6.3 security release.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Winter Vivern (TA473) espionage group against European governmental webmail from at least October 2023; a crafted plain-text email link executed script in the victim's Roundcube session to steal mail and credentials. KEV ransomware use unconfirmed.",
@@ -90882,7 +90882,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Chrome's vulnerability process; exploitation attributed to a commercial-surveillance chain. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4762 (CWE-843, CVSS 8.8) + CISA KEV (added 2024-02-06) + Google Chrome stable-channel advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A V8 type-confusion in Chrome/Chromium exploited in the wild for arbitrary code execution via a crafted HTML page; associated with commercial-surveillance targeting and later flagged as exploited. Client-side and requires the victim to visit an attacker page. KEV ransomware use unconfirmed.",
@@ -91069,7 +91069,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Ivanti; exploitation analysis by Rapid7 and others. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21893 (CWE-918, CVSS 8.2) + CISA KEV (added 2024-01-31, ransomware=known) + Ivanti security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited from late January 2024 against internet-facing Ivanti Connect Secure / Policy Secure gateways; the SAML-component SSRF is chained with CVE-2024-21887 command injection for unauthenticated RCE, bypassing the initial mitigation. KEV flags known ransomware use, alongside nation-state and criminal exploitation. EPSS ~1.0.",
@@ -91167,7 +91167,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Atlassian; PoC/exploitation analysis by Rapid7 and ProjectDiscovery. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-22527 (CWE-74, CVSS 9.8) + CISA KEV (added 2024-01-24, ransomware=known) + Atlassian advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited from January 2024 against internet-facing Confluence Data Center and Server; the unauthenticated OGNL template injection yields RCE and was used to deploy cryptominers, Sliver C2 and webshells. KEV flags known ransomware use. EPSS ~1.0.",
@@ -91356,7 +91356,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by VMware; long-running exploitation attributed to UNC3886 by Mandiant. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-34048 (CWE-787, CVSS 9.8) + CISA KEV (added 2024-01-22) + VMware VMSA-2023-0023.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the China-nexus espionage group UNC3886 since approximately 2021 — years before the October 2023 disclosure — to reach ESXi hosts and deploy VIRTUALPITA/VIRTUALPIE implants. Network-facing, unauthenticated, RCE-class. KEV ransomware use unconfirmed. EPSS ~0.99.",
@@ -91451,7 +91451,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Rapid7 while investigating CVE-2023-35078; disclosed by Ivanti. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-35082 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-01-18, ransomware=known) + Ivanti security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (CISA-confirmed January 2024) against internet-facing Ivanti EPMM / MobileIron Core MDM servers; unauthenticated attackers reach restricted API endpoints to read user PII and make server changes, and it can be chained toward RCE. KEV flags known ransomware use. EPSS ~1.0.",
@@ -91546,7 +91546,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Chrome's vulnerability process; Google withheld exploit detail while patches propagated. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-0519 (CWE-787/CWE-125, CVSS 8.8) + CISA KEV (added 2024-01-17) + Google Chrome stable-channel advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day (January 2024); an out-of-bounds memory access in V8 reachable from a crafted HTML page allows heap corruption and potential code execution in the renderer. Client-side and requires visiting an attacker page. KEV ransomware use unconfirmed.",
@@ -91637,7 +91637,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Cloud Software Group / Citrix PSIRT after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-6549 (CWE-119, CVSS 7.5) + CISA KEV (added 2024-01-17) + Citrix security bulletin CTX584986.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day disclosed alongside CVE-2023-6548 on 16 Jan 2024; the out-of-bounds read on NetScaler appliances configured as a Gateway (VPN/ICA Proxy/CVPN/RDP Proxy) or AAA virtual server crashes the packet-processing engine, removing remote access for the whole estate. CISA KEV ransomware flag: unknown.",
@@ -91733,7 +91733,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Cloud Software Group / Citrix PSIRT after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-6548 (CWE-94, CVSS 8.8) + CISA KEV (added 2024-01-17) + Citrix security bulletin CTX584986.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day disclosed 16 Jan 2024 alongside CVE-2023-6549; a low-privileged authenticated user with access to the NetScaler management interface (NSIP, CLIP, or SNIP) achieves remote code execution on the appliance. CISA KEV ransomware flag: unknown.",
@@ -91832,7 +91832,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Object-injection gadget-chain research (phpggc, Ambionics/community) with fix in Laravel 5.6.30. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2018-15133 (CWE-502, CVSS 8.1) + CISA KEV (added 2024-01-16) + Laravel 5.6.30 upgrade advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited: attackers harvest Laravel APP_KEY values leaked through exposed .env files or prior compromise, then forge an encrypted X-XSRF-TOKEN whose decrypted payload is unserialized into a PHP object-injection gadget chain for remote code execution. CISA KEV ransomware flag: unknown.",
@@ -91926,7 +91926,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Nguyen Tien Giang (Jang) of STAR Labs, demonstrated at Pwn2Own Vancouver 2023. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29357 (CWE-303, CVSS 9.8) + CISA KEV (added 2024-01-10, ransomware: known) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited and CISA-flagged as ransomware-associated; an unauthenticated attacker who obtains a spoofed JWT bypasses authentication to gain SharePoint administrator privileges, and it chains with CVE-2023-24955 for unauthenticated RCE (the STAR Labs Pwn2Own Vancouver 2023 chain).",
@@ -92019,7 +92019,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered in-the-wild and reported by Volexity with Ivanti/Mandiant; state-linked exploitation (UTA0178). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46805 (CWE-287, CVSS 8.2) + CISA KEV (added 2024-01-10, ransomware: known) + Ivanti forums advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited zero-day (CISA-flagged ransomware-associated); a remote unauthenticated attacker uses directory traversal in the web component to bypass control checks and reach restricted endpoints, and chains with CVE-2024-21887 command injection for unauthenticated RCE across the Ivanti Connect Secure / Policy Secure fleet.",
@@ -92116,7 +92116,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered in-the-wild and reported by Volexity with Ivanti/Mandiant; state-linked exploitation (UTA0178). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21887 (CWE-77, CVSS 9.1) + CISA KEV (added 2024-01-10, ransomware: known) + Ivanti forums advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited zero-day (CISA-flagged ransomware-associated); an authenticated administrator sends crafted requests to the ICS/IPS web components to execute arbitrary commands, and when chained with the CVE-2023-46805 auth bypass it becomes fully unauthenticated RCE used to drop webshells (e.g. GIFTEDVISITOR, WIREFIRE) across the fleet.",
@@ -92212,7 +92212,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Joomla project (Zewei Zhang / community) and fixed in 4.2.8. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-23752 (CWE-284, CVSS 5.3) + CISA KEV (added 2024-01-08) + Joomla Security Centre advisory 894-20230201.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (CISA KEV); an improper access check on Joomla! 4.x REST endpoints lets an unauthenticated attacker read configuration, including MySQL database credentials, which is then used for lateral access. CISA KEV ransomware flag: unknown.",
@@ -92305,7 +92305,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Public exploit since 2016; adopted by IoT botnets. D-Link addressed via end-of-life/replacement notice SAP10088. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2016-20017 (CWE-77, CVSS 9.8) + CISA KEV (added 2024-01-08) + D-Link support announcement SAP10088.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild from 2016 through 2022, primarily by IoT botnets (Mirai/Moobot-class), which use unauthenticated command injection via the login.cgi cli parameter to enlist DSL-2750B routers. The device line is end-of-life and unpatched. CISA KEV ransomware flag: unknown.",
@@ -92397,7 +92397,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Kaspersky (Operation Triangulation) and patched by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41990 (no NVD CWE; classified out-of-bounds write CWE-787; CVSS 7.8) + CISA KEV (added 2024-01-08) + Apple advisory HT213599 (and companion HT213601/HT213605/HT213606).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-click 0-day in the Operation Triangulation iPhone espionage campaign (Kaspersky): a malicious iMessage attachment processes a font using an undocumented Apple-only ADJUST TrueType instruction to achieve code execution against iOS versions before 15.7.1. Espionage-motivated; CISA KEV ransomware flag: unknown.",
@@ -92496,7 +92496,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Naveen Sunkavally (Horizon3.ai); fixed in Superset 2.1.0, which refuses to start on a default SECRET_KEY. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-27524 (CWE-1188, CVSS 9.8) + CISA KEV (added 2024-01-08) + Apache Superset security advisory (lists.apache.org).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (CISA KEV); attackers use one of Apache Superset's shipped default SECRET_KEY values to forge a signed session cookie, authenticate as an administrator, and then leverage admin access (database connections / SQL Lab / charts) toward remote code execution. CISA KEV ransomware flag: unknown.",
@@ -92589,7 +92589,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe and fixed in APSB23-40; ProjectDiscovery published subsequent gadget-chain analysis. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29300 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-01-08) + Adobe APSB23-40.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild against internet-facing Adobe ColdFusion servers since mid-2023 to drop web shells; CISA KEV flags associated ransomware use. EPSS is in the top percentile (~1.0).",
@@ -92684,7 +92684,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Surfaced via ProjectDiscovery research (a new gadget chain Adobe fixed out-of-band in APSB23-41). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-38203 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-01-08) + Adobe APSB23-41.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A denylist-bypass zero-day in ColdFusion's deserialization, disclosed inadvertently and fixed by Adobe out-of-band; exploited in the wild alongside the other 2023 ColdFusion flaws, with ransomware association per CISA KEV.",
@@ -92781,7 +92781,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified by Barracuda with Mandiant during Barracuda ESG (UNC4841) incident response. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-7101 (CWE-95/CWE-94, CVSS 7.8) + CISA KEV (added 2024-01-02) + GitHub advisory GHSA-3c85-mx4x-435c.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by China-nexus actor UNC4841 against Barracuda Email Security Gateway appliances (late-December 2023 wave) by mailing crafted Excel attachments; the flaw lives in the widely embedded Spreadsheet::ParseExcel Perl module rather than a single product.",
@@ -92967,7 +92967,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Akamai SIRT during the InfectedSlurs botnet investigation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-49897 (CWE-78, CVSS 8.8) + CISA KEV (added 2023-12-21) + FXC advisory (2023-12-06).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Mirai-variant 'InfectedSlurs' botnet (reported by Akamai SIRT) to conscript FXC AE1021/AE1021PE wall routers into a DDoS swarm; authenticated command injection over the network.",
@@ -93063,7 +93063,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Akamai SIRT during the InfectedSlurs botnet investigation; QNAP published QSA-23-48. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-47565 (CWE-78, CVSS 8.8) + CISA KEV (added 2023-12-21) + QNAP advisory QSA-23-48.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the InfectedSlurs Mirai-variant botnet (Akamai SIRT) against legacy QNAP VioStor NVR devices on QVR firmware 4.x, enrolling them into a DDoS botnet; authenticated command injection over the network.",
@@ -93159,7 +93159,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Surfaced through coordinated disclosure and CISA/EPA incident response to the CyberAv3ngers water-sector attacks; documented in the Unitronics advisory. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-6448 (CWE-1188/CWE-798, CVSS 9.8) + CISA KEV (added 2023-12-11) + Unitronics Cybersecurity Advisory 2023-001.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited by the Iran-affiliated CyberAv3ngers against internet-exposed Unitronics Vision/Samba PLCs and HMIs in late 2023, including U.S. water-utility systems (e.g. Aliquippa, PA), by logging in with the publicly known factory default password; CISA/EPA issued alerts.",
@@ -93254,7 +93254,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Praetorian (ZeroQlik research). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41266 (CWE-22, CVSS 6.5) + CISA KEV (added 2023-12-07) + Qlik community security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Chained with CVE-2023-41265 for unauthenticated RCE and used as initial access by Cactus ransomware against internet-facing Qlik Sense Enterprise for Windows (observed by Arctic Wolf); CISA KEV flags ransomware use.",
@@ -93352,7 +93352,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Praetorian (ZeroQlik research). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41265 (CWE-444, CVSS 9.9) + CISA KEV (added 2023-12-07) + Qlik community security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "The privilege-escalation link of the ZeroQlik chain: combined with CVE-2023-41266 it gives unauthenticated RCE on Qlik Sense Enterprise for Windows and was used by Cactus ransomware for initial access (Arctic Wolf); CISA KEV flags ransomware use.",
@@ -93450,7 +93450,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Qualcomm flagged limited, targeted exploitation based on indications from Google's Threat Analysis Group / Project Zero; fixed via the December 2023 bulletin. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33107 (CWE-190, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm December 2023 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Qualcomm flagged this Adreno GPU (Graphics/kgsl) integer-overflow memory-corruption issue as under limited, targeted in-the-wild exploitation (December 2023 bulletin), consistent with a local privilege-escalation stage in mobile exploit chains; affects a broad range of Qualcomm chipsets.",
@@ -93542,7 +93542,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Exploitation identified and reported by Google Threat Analysis Group and Google Project Zero. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33106 (CWE-823, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm December 2023 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Flagged by Google Threat Analysis Group and Google Project Zero as being under limited, targeted exploitation against Android devices; Qualcomm confirmed exploitation and issued OEM guidance. Ransomware use not observed (targeted-spyware pattern).",
@@ -93633,7 +93633,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Exploitation reported by Google Threat Analysis Group and Google Project Zero. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33063 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm December 2023 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Named by Google Threat Analysis Group and Google Project Zero as being under limited, targeted exploitation alongside the Adreno GPU flaws; Qualcomm confirmed and issued OEM guidance. No ransomware association (targeted-spyware pattern).",
@@ -93724,7 +93724,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Qualcomm's security bulletin; subsequent exploitation flagged by Google Threat Analysis Group/Project Zero. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2022-22071 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-12-05) + Qualcomm May 2022 security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV alongside the other Qualcomm chipset flaws that Google TAG/Project Zero flagged as under limited, targeted exploitation. No ransomware association reported.",
@@ -93815,7 +93815,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Apple / Google Threat Analysis Group (Clement Lecigne). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42917 (CWE-787, CVSS 8.8) + CISA KEV (added 2023-12-04) + Apple security advisory HT214031.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple confirmed a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.1 — a targeted-spyware exploitation pattern. No ransomware association.",
@@ -93909,7 +93909,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Clement Lecigne of Google Threat Analysis Group. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42916 (CWE-125, CVSS 6.5) + CISA KEV (added 2023-12-04) + Apple security advisory HT214031.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple confirmed a report that this issue may have been exploited against versions of iOS before iOS 16.7.1; it is the information-disclosure companion to the WebKit code-execution zero-day patched in the same release. No ransomware association.",
@@ -94097,7 +94097,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by ownCloud PSIRT. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-49103 (CWE-200, CVSS 7.5) + CISA KEV (added 2023-11-30) + ownCloud security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited within days of disclosure by automated scanning (EPSS ~0.78, 99th percentile); listed in CISA KEV. Exposed container environment variables including ownCloud admin password, mail credentials, and license keys. No specific ransomware attribution, but harvested credentials enable follow-on intrusion.",
@@ -94199,7 +94199,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by the Qualys Threat Research Unit. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4911 (CWE-122, CVSS 7.8) + CISA KEV (added 2023-11-21) + Qualys 'Looney Tunables' advisory and distribution security updates.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Known as 'Looney Tunables'; added to CISA KEV after confirmed exploitation, including by the Kinsing threat actor for privilege escalation in cloud/Linux environments to deploy cryptominers. Ubiquitous exposure on Linux systems using a vulnerable glibc. No ransomware association, but LPE enables broad post-access impact.",
@@ -94292,7 +94292,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft and remediated in the October 2023 update; associated with RomCom/Storm-0978 activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36584 (Windows MOTW security-feature bypass, CVSS 5.4) + CISA KEV (added 2023-11-16) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as part of phishing intrusion chains (associated with RomCom / Storm-0978 activity) to suppress Mark-of-the-Web so that SmartScreen/Protected View warnings do not trigger on downloaded files. Limited direct impact on its own; potent as a delivery-stage evasion. No ransomware association in this component.",
@@ -94386,7 +94386,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Sophos and fixed in 4.3.10.4. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-1671 (CWE-77, CVSS 9.8) + CISA KEV (added 2023-11-16) + Sophos advisory SA-20230404-SWA-RCE.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV as actively exploited; EPSS ~1.0 (top percentile) reflecting widespread exploitation attempts. Pre-authentication command injection gives full remote code execution on internet-facing appliances; the product is end-of-life, raising the risk of unpatched exposed instances. No specific ransomware attribution.",
@@ -94479,7 +94479,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Oracle's Critical Patch Update (Jan 2020); researcher-reported through Oracle's coordinated program. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-2551 (deserialization via IIOP, CVSS 9.8) + CISA KEV (added 2023-11-16) + Oracle CPU Jan 2020 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-11-16; the IIOP-facing WLS Core Components flaw has been mass-scanned and weaponized since the Jan-2020 Oracle CPU, remaining a durable initial-access vector against internet-exposed WebLogic. EPSS 0.93 (99.8th pct). Ransomware use unconfirmed but common on WebLogic footholds.",
@@ -94572,7 +94572,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft after in-the-wild detection (credited to Quan Jin / DBAPPSecurity WeBin Lab in the MSRC advisory). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36033 (CWE-822/CWE-119, CVSS 7.8) + CISA KEV (added 2023-11-14) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day and patched in the Nov 2023 Patch Tuesday; the attacker used a novel technique to escalate from the Window Manager\\DWM account to SYSTEM. Tracked by Google Project Zero's 0days-in-the-wild. Ransomware use unconfirmed. EPSS 0.12 (95.7th pct) reflects it being a post-foothold LPE, not a mass-scanned preauth flaw.",
@@ -94667,7 +94667,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft after in-the-wild detection (credited to multiple researchers in the MSRC advisory). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36025 (SmartScreen security-feature bypass, CVSS 8.8) + CISA KEV (added 2023-11-14) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild via crafted Internet Shortcut (.url) files that suppress Defender SmartScreen prompts; abused by Phemedrone Stealer, DarkGate, and Mispadu campaigns. Patched Nov 14 2023. EPSS 0.88 (99.7th pct). No ransomware attribution but heavily used as a malware-delivery enabler.",
@@ -94759,7 +94759,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36036 (CWE-122/CWE-787, CVSS 7.8) + CISA KEV (added 2023-11-14) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day and patched in Nov 2023; a low-privilege attacker escalates to SYSTEM through a heap-based overflow in the Cloud Files Mini Filter Driver (cldflt.sys). Ransomware use unconfirmed. EPSS 0.17 (96.7th pct) reflects a post-foothold LPE rather than a mass-scanned preauth flaw.",
@@ -94950,7 +94950,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36844 (CWE-473, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the actively-exploited Juniper J-Web pre-auth RCE chain (with CVE-2023-36845/36846/36847); exploitation attempts were observed from Aug 25 2023, about a week after Juniper's patch and watchTowr's PoC. Alone it is a preauth PHP environment-variable modification (partial integrity loss) that is chained upward. EPSS 0.91 (99.8th pct). Ransomware use unconfirmed.",
@@ -95051,7 +95051,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); RCE weaponized publicly by watchTowr Labs (single-request variant later shown by VulnCheck). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36845 (CWE-473, CVSS 9.8) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "The critical RCE anchor of the Juniper J-Web chain: by setting the PHPRC environment variable via a crafted request an unauthenticated attacker loads a malicious PHP config and executes code. Exploitation observed from Aug 25 2023, ~a week after patch and watchTowr's PoC; ~12,000 SRX/EX devices were reported internet-exposed. EPSS 0.94 (99.8th pct). Ransomware use unconfirmed.",
@@ -95155,7 +95155,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36846 (CWE-306, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the actively-exploited Juniper J-Web pre-auth RCE chain; an unauthenticated request to user.php uploads arbitrary files via J-Web on SRX Series, providing the file-write primitive combined with CVE-2023-36845 for RCE. Exploitation observed from Aug 25 2023. EPSS 0.94 (99.8th pct). Ransomware use unconfirmed.",
@@ -95257,7 +95257,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36847 (CWE-306, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the actively-exploited Juniper J-Web pre-auth RCE chain; an unauthenticated request to installAppPackage.php uploads arbitrary files via J-Web on EX Series, providing the file-write primitive that chains toward RCE. Exploitation observed from Aug 25 2023. EPSS 0.85 (99.7th pct). Ransomware use unconfirmed.",
@@ -95359,7 +95359,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Juniper SIRT (JSA72300); chain weaponized publicly by watchTowr Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36851 (CWE-306, CVSS 5.3) + CISA KEV (added 2023-11-13) + Juniper JSA72300.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the Juniper J-Web pre-auth chain; an unauthenticated request to webauth_operation.php allows uploading and downloading arbitrary files on SRX Series, giving both a file-write primitive (for RCE chaining) and arbitrary-file read. CISA KEV'd 2023-11-13. Its EPSS is far lower (0.011, 61.7th pct) than the sibling CVEs, reflecting narrower standalone weaponization. Ransomware use unconfirmed.",
@@ -95460,7 +95460,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by BitSight (Pedro Umbelino) and Curesec. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-29552 (no NVD CWE assigned, CVSS 7.5) + CISA KEV (added 2023-11-08) + BitSight/Curesec SLP disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA-KEV listed; SLP-enabled hosts reachable on UDP/427 are abused as reflectors/amplifiers to launch spoofed-source DDoS with amplification factors reported above 2000x. No ransomware association.",
@@ -95554,7 +95554,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported and disclosed by Atlassian PSIRT. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-22518 (CWE-863, CVSS 9.8) + CISA KEV (added 2023-11-07) + Atlassian advisory CONFSERVER-93142.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited shortly after disclosure; the Cerber ransomware crew and other actors used it to reset instances and seize admin control. CISA-KEV flags known ransomware use. Confluence Cloud (atlassian.net) is not affected.",
@@ -95653,7 +95653,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and disclosed by the Apache ActiveMQ project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46604 (CWE-502, CVSS 9.8) + CISA KEV (added 2023-11-02) + Apache ActiveMQ security announcement.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Heavily exploited in the wild against internet-exposed OpenWire brokers (TCP/61616) to deploy ransomware (HelloKitty, TellYouThePass) as well as Kinsing, SparkRAT and cryptominers. CISA-KEV flags known ransomware use.",
@@ -95751,7 +95751,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Michael Weber and Thomas Hendrickson of Praetorian; disclosed by F5. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46748 (CWE-89, CVSS 8.8) + CISA KEV (added 2023-10-31) + F5 advisory K000137365.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild, typically chained with the CVE-2023-46747 authentication bypass to reach the Configuration utility unauthenticated and then run system commands. CISA-KEV ransomware status unknown.",
@@ -95850,7 +95850,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Michael Weber and Thomas Hendrickson of Praetorian; disclosed by F5. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-46747 (CWE-288/CWE-306, CVSS 9.8) + CISA KEV (added 2023-10-31) + F5 advisory K000137353.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as the unauthenticated entry point (via AJP/mod_proxy request smuggling to the internal Tomcat) that reaches the Configuration utility to run system commands, commonly chained with CVE-2023-46748. CISA-KEV flags known ransomware use.",
@@ -95949,7 +95949,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "In-the-wild exploitation reported by ESET (Matthieu Faou); fixed by the Roundcube project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-5631 (CWE-79, CVSS 5.4) + CISA KEV (added 2023-10-26) + Roundcube 1.6.4/1.5.5/1.4.15 release advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild by the Winter Vivern (TA473) espionage group against government webmail targets: a crafted SVG in an HTML email ran JavaScript in the victim's Roundcube session to exfiltrate mail. CISA-KEV ransomware status unknown.",
@@ -96140,7 +96140,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Citrix; root cause reverse-engineered and published by Assetnote (Dylan Pindur). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4966 (CWE-119, CVSS 7.5) + CISA KEV (added 2023-10-18) + Citrix advisory CTX579459.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Widely exploited as 'Citrix Bleed': a buffer over-read leaks session tokens from NetScaler memory, letting attackers hijack authenticated sessions and bypass MFA. Mass-exploited by LockBit and other ransomware/extortion actors; CISA-KEV flags known ransomware use.",
@@ -96334,7 +96334,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe by external researchers credited in APSB23-01. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-21608 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-10-10) + Adobe advisory APSB23-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild against Adobe Acrobat/Reader users: opening a malicious PDF triggers a use-after-free yielding arbitrary code execution as the current user. CISA-KEV ransomware status unknown.",
@@ -96521,7 +96521,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by security researcher Gerald Doussot (NCC Group) / independent research (Frycos). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41763 (CWE-918, CVSS 5.3) + CISA KEV (added 2023-10-10) + Microsoft MSRC advisory for CVE-2023-41763.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed and actively exploited; EPSS is very high (0.90), consistent with widespread internet scanning of on-prem Skype for Business Server. No ransomware association is recorded.",
@@ -96611,7 +96611,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft via coordinated disclosure (credited in the October 2023 update guide). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36563 (CWE-20, CVSS 5.5) + CISA KEV (added 2023-10-10) + Microsoft MSRC advisory for CVE-2023-36563.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed and actively exploited; the flaw discloses NTLM credential material and can be chained into relay/authentication attacks. No ransomware association is recorded.",
@@ -96803,7 +96803,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Progress by Assetnote (Shubham Shah and Sean Yeoh) research. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-40044 (CWE-502, CVSS 8.8) + CISA KEV (added 2023-10-05, ransomware: known) + Progress WS_FTP Server September 2023 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed with a known ransomware association; EPSS ~0.90. Public exploitation followed rapidly after Assetnote's disclosure, targeting internet-facing WS_FTP Server Ad Hoc Transfer modules.",
@@ -96894,7 +96894,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Addressed by Apple as an actively-exploited issue; Apple did not publicly credit an external reporter. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42824 (no NVD CWE assigned, CVSS 7.8) + CISA KEV (added 2023-10-05) + Apple advisory HT213972.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple acknowledged a report that this kernel flaw may have been actively exploited against versions of iOS before iOS 16.6, consistent with targeted mobile-surveillance use. No ransomware association is recorded.",
@@ -96991,7 +96991,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to JetBrains by Sonar (Stefan Schiller) research. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-42793 (CWE-288, CWE-306, CVSS 9.8) + CISA KEV (added 2023-10-04, ransomware: known) + JetBrains TeamCity post-mortem advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild by nation-state actors (Russia's APT29 and North Korea's Lazarus/Diamond Sleet) against internet-facing TeamCity servers; CISA KEV flags a known ransomware association and EPSS is ~0.9998. TeamCity's CI role makes it a supply-chain pivot point.",
@@ -97083,7 +97083,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by @k0shl of Cyber Kunlun. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-28229 (CWE-591, CVSS 7.0) + CISA KEV (added 2023-10-04) + Microsoft MSRC advisory for CVE-2023-28229.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEV-listed as actively exploited; the flaw yields limited SYSTEM privileges from a low-privileged local context. No ransomware association is recorded.",
@@ -97175,7 +97175,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported to Arm by Maddie Stone (Google Threat Analysis Group) and Jann Horn (Google Project Zero). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4211 (CWE-416, CVSS 5.5) + CISA KEV (added 2023-10-03) + Arm Mali GPU Driver Vulnerabilities advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Arm warned the flaw may be under limited, targeted exploitation; Google TAG attributed in-the-wild use to a commercial surveillance (spyware) vendor. The affected Mali GPU kernel drivers are present across a very large Android device population. No ransomware association is recorded.",
@@ -97362,7 +97362,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Red Hat Product Security (CVE-2018-14667). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2018-14667 (CWE-94, CVSS 9.8) + CISA KEV (added 2023-09-28) + Red Hat RHSA-2018:3517.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-28; the RichFaces UserResource EL-injection deserialization chain is exploited against internet-facing JBoss/JSF applications for unauthenticated RCE (EPSS ~0.74). KEV ransomware status: unknown.",
@@ -97458,7 +97458,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Bill Marczak (Citizen Lab) and Maddie Stone (Google Threat Analysis Group); fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41991 (CWE-295, CVSS 5.5) + CISA KEV (added 2023-09-25) + Apple HT213927/HT213931.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One link of the Predator/Intellexa commercial-spyware exploit chain (with CVE-2023-41992 and CVE-2023-41993) reported by Citizen Lab and Google TAG; Apple confirmed active exploitation against iOS before 16.7. KEV ransomware status: unknown.",
@@ -97554,7 +97554,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Bill Marczak (Citizen Lab) and Maddie Stone (Google Threat Analysis Group); fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41992 (CWE-754, CVSS 7.8) + CISA KEV (added 2023-09-25) + Apple HT213927/HT213932.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Kernel LPE used as the privilege-escalation stage of the Predator/Intellexa spyware chain (with CVE-2023-41991 and CVE-2023-41993), reported by Citizen Lab and Google TAG; Apple confirmed active exploitation against iOS before 16.7. KEV ransomware status: unknown.",
@@ -97647,7 +97647,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Bill Marczak (Citizen Lab) and Maddie Stone (Google Threat Analysis Group); fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41993 (CWE-754, CVSS 8.8) + CISA KEV (added 2023-09-25) + Apple HT213940.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "WebKit RCE that served as the browser-based entry point of the Predator/Intellexa spyware chain (with CVE-2023-41991/41992); reported by Citizen Lab and Google TAG; Apple confirmed active exploitation against iOS before 16.7. Impact extends to non-Apple products embedding WebKit. KEV ransomware status: unknown.",
@@ -97737,7 +97737,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Handled by Trend Micro PSIRT after observed in-the-wild exploitation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41179 (CWE-94, CVSS 7.2) + CISA KEV (added 2023-09-21) + Trend Micro solution 000294994.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day before the fix; CISA added it 2023-09-21. Requires prior administrative-console access, then abuses the 3rd-party AV uninstaller module to run arbitrary commands on the affected Trend Micro management install. KEV ransomware status: unknown.",
@@ -97834,7 +97834,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported and fixed by the MinIO maintainers via GitHub Security Advisory GHSA-2pxw-r47w-4p8c. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-28434 (CWE-269, CVSS 8.8) + CISA KEV (added 2023-09-19) + MinIO GHSA-2pxw-r47w-4p8c.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-19; exploited in the wild and frequently chained with CVE-2023-28432 to escalate from limited credentials to arbitrary object writes on internet-exposed MinIO consoles. KEV ransomware status: unknown.",
@@ -97922,7 +97922,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Samsung Mobile Security in the January 2022 SMR. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2022-22265 (CWE-703, CVSS 7.8) + CISA KEV (added 2023-09-18) + Samsung Mobile Security bulletin (SMR Jan-2022 Release 1).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-18; the Samsung Exynos NPU driver flaw allows arbitrary kernel memory write and code execution from a local context and has been used in targeted device-compromise chains. Very low EPSS reflects no commodity exploit. KEV ransomware status: unknown.",
@@ -98013,7 +98013,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by security researchers and fixed by affected OEMs (e.g., D-Link SAP10055). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-8361 (no NVD CWE; command injection, CVSS 9.8) + CISA KEV (added 2023-09-18) + D-Link SAP10055 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild through 2023 (EPSS ~0.9998); the Realtek SDK miniigd SOAP RCE is a staple of Mirai/Gafgyt-class IoT botnets targeting the vast population of consumer routers/IoT devices embedding the SDK. Added to CISA KEV 2023-09-18. KEV ransomware status: unknown.",
@@ -98107,7 +98107,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by an independent researcher; Zyxel published a security advisory for the EMG2926-Q10A. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-6884 (CWE-78, CVSS 8.8) + CISA KEV (added 2023-09-18) + Zyxel EMG2926-Q10A security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-18 and flagged as leveraged in ransomware campaigns (KEV ransomware: known). The Zyxel EMG2926 nslookup diagnostic command injection is exploited by botnets against exposed SOHO routers. EPSS ~0.38.",
@@ -98201,7 +98201,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Charles Fol (Ambionics Security); fixed in Ignition 2.5.2. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-3129 (no NVD CWE; code injection via insecure file operations, CVSS 9.8) + CISA KEV (added 2023-09-18) + Facade Ignition advisory / Ambionics writeup.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2023-09-18 and flagged as leveraged in ransomware campaigns (KEV ransomware: known). The Laravel Ignition debug-mode RCE (EPSS ~0.999) is mass-exploited against internet-facing Laravel apps left in debug mode.",
@@ -98294,7 +98294,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe and fixed in APSB23-34; exploited in the wild. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-26369 (CWE-787, CVSS 7.8) + CISA KEV (added 2023-09-14) + Adobe APSB23-34.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day before Adobe's September 2023 fix; a victim must open a malicious PDF, yielding arbitrary code execution in the current user's context. CISA added it to KEV on 2023-09-14.",
@@ -98386,7 +98386,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Google in the Android Framework; noted as under limited targeted exploitation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-35674 (CWE-269, CVSS 7.8) + CISA KEV (added 2023-09-13) + Android Security Bulletin 2023-09-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Android Security Bulletin flagged this as under limited, targeted exploitation before the September 2023 fix. A malicious installed app launches a background activity via a WindowState logic error to escalate privilege with no user interaction. CISA added it to KEV on 2023-09-13.",
@@ -98480,7 +98480,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Cisco PSIRT published the advisory after incident responders observed Akira ransomware actors abusing ASA/FTD RA VPN. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-20269 (CWE-288/CWE-863, CVSS 9.1) + CISA KEV (added 2023-09-13, ransomware known) + Cisco advisory cisco-sa-asaftd-ravpn-auth-8LyfCkeC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by Akira (and other) ransomware operators for initial access against Cisco ASA/FTD remote-access VPNs lacking MFA; KEV flags ransomware use as known. The AAA-separation flaw lets an unauthenticated attacker brute-force valid credentials against a default tunnel group, and lets a clientless SSL VPN session be established on ASA 9.16 and earlier.",
@@ -98575,7 +98575,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at the University of Toronto's Munk School. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4863 (CWE-787, CVSS 8.8) + CISA KEV (added 2023-09-13) + Google Chrome stable-channel advisory (crbug 1479274).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited zero-day (reported by Apple SEAR and Citizen Lab) in the BLASTPASS-adjacent wave; a crafted WebP image triggers a heap buffer overflow in libwebp's Huffman-table decoder, reachable from any renderer that decodes WebP. EPSS ~0.997. CISA added it to KEV on 2023-09-13.",
@@ -98667,7 +98667,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and fixed by Microsoft; exploited in the wild. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36761 (CWE-20, CVSS 6.5) + CISA KEV (added 2023-09-12) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day patched by Microsoft in September 2023. Opening — or merely previewing in the Preview Pane — a crafted Office/Word document forces an outbound authentication that leaks the victim's NetNTLM hash to an attacker-controlled host, enabling relay or offline cracking. CISA added it to KEV on 2023-09-12.",
@@ -98763,7 +98763,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Credited to researchers including Valentina Palmiotti (IBM X-Force), Quan Jin (DBAPPSecurity), and Google Threat Analysis Group / Mandinet reporting; fixed by Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-36802 (CWE-416, CVSS 7.8) + CISA KEV (added 2023-09-12) + MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day (analyzed by Google Project Zero's in-the-wild program) and patched by Microsoft in September 2023. A use-after-free / type confusion in the mskssrv kernel driver lets a local low-privileged process elevate to NT AUTHORITY\\SYSTEM. CISA added it to KEV on 2023-09-12.",
@@ -98857,7 +98857,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by The Citizen Lab at the University of Toronto's Munk School while analyzing an actively-exploited device; fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41064 (CWE-120, CVSS 7.8) + CISA KEV (added 2023-09-11) + Apple HT213905.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Zero-click zero-day discovered by The Citizen Lab as the BLASTPASS chain (with CVE-2023-41061) used to deliver NSO Group's Pegasus spyware to iPhones. A maliciously crafted image processed by ImageIO overflows a buffer, leading to arbitrary code execution. CISA added it to KEV on 2023-09-11.",
@@ -98952,7 +98952,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by The Citizen Lab while analyzing an actively-exploited device; fixed by Apple. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-41061 (CWE-20, CVSS 7.8) + CISA KEV (added 2023-09-11) + Apple HT213905/HT213907.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Zero-click zero-day discovered by The Citizen Lab as the second half of the BLASTPASS chain (with CVE-2023-41064) delivering NSO Group's Pegasus. A validation flaw in Wallet lets a maliciously crafted attachment achieve arbitrary code execution. CISA added it to KEV on 2023-09-11.",
@@ -99045,7 +99045,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and fixed by the Apache RocketMQ project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-33246 (CWE-94, CVSS 9.8) + CISA KEV (added 2023-09-06) + Apache RocketMQ advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited preauth RCE; the DreamBus botnet weaponized it against internet-exposed RocketMQ brokers. NameServer/Broker/Controller components exposed to the extranet lack permission verification, so an attacker uses the update-configuration function (or forges the RocketMQ protocol) to run commands as the RocketMQ service user. EPSS ~0.966. CISA added it to KEV on 2023-09-06.",
@@ -99139,7 +99139,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Group-IB during investigation of in-the-wild attacks; fixed by RARLAB in WinRAR 6.23. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-38831 (CWE-345/CWE-351, CVSS 7.8) + CISA KEV (added 2023-08-24, ransomware known) + RARLAB WinRAR 6.23 release notes.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild April–October 2023 (initially by financially-motivated actors against traders, later by state-linked groups); KEV flags ransomware use as known. A ZIP/RAR archive pairs a benign file with a same-named folder whose executable contents run when the victim opens the decoy in WinRAR before 6.23. EPSS ~0.978. CISA added it to KEV on 2023-08-24.",
@@ -99228,7 +99228,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Coordinated disclosure via Microsoft MSRC. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-58644 (CWE-502, CVSS 9.8) + CISA KEV (added 2026-07-16) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-16 with a 3-day due date, indicating confirmed active exploitation of internet-facing SharePoint servers. Ransomware use is not yet confirmed but deserialization RCE on SharePoint has historically been chained into web-shell drops and hands-on-keyboard intrusion.",
@@ -99320,7 +99320,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Fortinet PSIRT (FG-IR-26-141). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-25089 (CWE-78, CVSS 9.8) + CISA KEV (added 2026-07-16) + Fortinet PSIRT advisory FG-IR-26-141.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2026-07-16 with a 3-day BOD 26-04 deadline; honeypot telemetry and threat-intel vendors recorded unauthenticated exploitation attempts against exposed FortiSandbox management UIs since mid-June 2026. Ransomware use not confirmed.",
@@ -99419,7 +99419,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Fortinet PSIRT (FG-IR-26-100). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-39808 (CWE-78, CVSS 9.8) + CISA KEV (added 2026-07-16) + Fortinet PSIRT FG-IR-26-100.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2026-07-16 with a 3-day due date, citing crafted-HTTP-request exploitation of internet-facing FortiSandbox appliances by an unauthenticated attacker. Ransomware use is unconfirmed but the compressed remediation window signals observed active exploitation.",
@@ -99514,7 +99514,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Oracle's May 2026 Critical Patch Update; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-46817 (CWE-269/CWE-287/CWE-306, CVSS 9.8) + CISA KEV (added 2026-07-15) + Oracle Critical Patch Update May 2026 (cspumay2026).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild against internet-facing Oracle E-Business Suite instances; decoy telemetry captured unauthenticated file-read probes (e.g. /etc/passwd via the Payments ibytransmit endpoint) in late June 2026, roughly six weeks after the May 2026 patch. Over 900 EBS instances were reported internet-exposed. CISA KEV ransomware status: Unknown.",
@@ -99618,7 +99618,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through the KNX Association / coordinated ICS disclosure (CISA ICSA-23-236-01). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-4346 (CWE-645, CVSS 7.5) + CISA KEV (added 2026-07-15) + CISA ICS advisory ICSA-23-236-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-15 as actively exploited. An attacker with network (or physical) access to a KNX installation using Connection Authorization Option 1 can purge unprotected devices and set a BCU key, permanently locking building-automation controllers out of operator control. Ransomware association is unconfirmed.",
@@ -99707,7 +99707,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Microsoft MSRC as an actively-exploited zero-day. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56155 (CWE-1220, CVSS 7.8) + CISA KEV (added 2026-07-14) + Microsoft MSRC / KB5121391 DKM ACL hardening advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited as a zero-day disclosed in Microsoft's July 2026 Patch Tuesday; ZDI flagged it as the only AD FS bug patched that month under active attack and warned it can be paired with an RCE as commonly seen in ransomware intrusions. Ransomware status listed Unknown by CISA.",
@@ -99802,7 +99802,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported via Mandiant/Google FLARE incident response. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56164 (CWE-306, CVSS 9.8) + CISA KEV (added 2026-07-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Confirmed exploited in the wild as a zero-day before the July 14 2026 patch; discovery credited to Mandiant incident responders and Google's FLARE team, indicating the flaw was found inside active intrusions rather than routine research. CISA added it to KEV the same day with a 3-day due date. Ransomware association: Unknown.",
@@ -99897,7 +99897,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via SonicWall PSIRT (SNWLID-2026-0008). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-15409 (CWE-918, CVSS 10.0) + CISA KEV (added 2026-07-14) + SonicWall PSIRT advisory SNWLID-2026-0008.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-14 under BOD 26-04 with a 3-day due date, indicating observed in-the-wild abuse against internet-facing SonicWall SMA1000 remote-access appliances. CISA's record marks ransomware campaign use as Known, without naming a campaign or an operator.",
@@ -99986,7 +99986,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through SonicWall PSIRT. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-15410 (CWE-94, CVSS 7.2) + CISA KEV (added 2026-07-14) + SonicWall PSIRT advisory SNWLID-2026-0008.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2026-07-14 with a 3-day due date, signalling observed in-the-wild abuse of SMA1000 SSL-VPN appliances, and marks ransomware campaign use as Known without naming a campaign or an operator. Exploitation requires an authenticated administrator session on the Appliance Management Console.",
@@ -100081,7 +100081,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Originally third-party disclosed against Cisco IOS HTTP admin; re-surfaced via CISA KEV. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2008-4128 (CWE-352, CVSS 4.3) + CISA KEV (added 2026-07-13) + Cisco IOS 12.4 end-of-support guidance.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-13 amid renewed exploitation of legacy edge devices; public reporting attributes abuse of this 18-year-old Cisco IOS HTTP-admin CSRF to Russian FSB Center 16-linked actors targeting the retired IOS 12.4 web management interface. Ransomware use not flagged.",
@@ -100178,7 +100178,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Oracle's coordinated disclosure and fixed in the July 2020 Critical Patch Update; researcher-credited, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-14644 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-09-18) + Oracle Critical Patch Update Advisory - July 2020.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-18 as an actively-exploited unauthenticated RCE. WebLogic T3/IIOP deserialization flaws are a persistent target for cryptomining, webshell-drop, and ransomware access brokers; ransomware use is unconfirmed but the class is heavily weaponized.",
@@ -100275,7 +100275,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Oracle by security researcher Peterjson / Jang (VNPT / independent) via Oracle's PSIRT and fixed in the April 2022 CPU. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-21445 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-09-18) + Oracle Critical Patch Update April 2022.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-18 as an actively-exploited unauthenticated RCE in Oracle ADF Faces (Fusion Middleware / WebLogic-hosted). No confirmed ransomware attribution, but internet-facing WebLogic estates are routinely swept for this by opportunistic and access-broker actors.",
@@ -100368,7 +100368,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by MDSec researcher Soroush Dalili (@irsdl). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-0618 (CWE-502, CVSS 8.8) + CISA KEV (added 2024-09-18) + Microsoft MSRC advisory CVE-2020-0618.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-exposed SQL Server Reporting Services instances; a low-privileged authenticated user posts a crafted __VIEWSTATE to a report page to run code as the Report Server service account. CISA's record marks ransomware campaign use as Known; the flaw is a foothold on exposed BI servers rather than the encryption stage itself.",
@@ -100464,7 +100464,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Apache HugeGraph PMC by external security researchers (Aliyun/other reporters credited on the Apache thread). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-27348 (CWE-284, CVSS 9.8) + CISA KEV (added 2024-09-18) + Apache HugeGraph security thread.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-18 after unauthenticated RCE was observed against internet-exposed HugeGraph-Server instances; the near-1.0 EPSS reflects mass opportunistic scanning and exploitation. Ransomware use not confirmed.",
@@ -100555,7 +100555,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Adobe PSIRT following in-the-wild detection by security researchers (FireEye). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-0502 (CWE-415, CVSS 8.8) + CISA KEV (added 2024-09-17) + Adobe APSB14-07.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in February 2014 as a drive-by / watering-hole zero-day (Operation GreedyWonk) against visitors of compromised policy and NGO sites; leveraged for browser-plugin remote code execution. Product is now end-of-life; CISA lists it as discontinue-use.",
@@ -100648,7 +100648,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe during the February 2013 targeted-attack wave; disclosed in bulletin APSB13-08. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-0648 (no NVD CWE; judged CWE-787/CWE-119, CVSS 8.8) + CISA KEV (added 2024-09-17) + Adobe bulletin APSB13-08.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in February 2013 as a zero-day in targeted attacks that lured users to sites serving malicious SWF content. Added to CISA KEV 2024-09-17; the product is end-of-life so the required action is to discontinue use.",
@@ -100739,7 +100739,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe during coordinated disclosure of the February 2013 in-the-wild Flash zero-days. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2013-0643 (CWE-269, CVSS 8.8) + CISA KEV (added 2024-09-17) + Adobe Security Bulletin APSB13-08.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in February 2013 in targeted attacks delivering crafted SWF content that escaped the Firefox Flash sandbox to run arbitrary code. The product is now end-of-life; CISA lists it as KEV with the required action to discontinue use.",
@@ -100832,7 +100832,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe by Kaspersky Lab following in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-0497 (CWE-191, CVSS 9.8) + CISA KEV (added 2024-09-17) + Adobe APSB14-04.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Discovered as an in-the-wild zero-day by Kaspersky in early 2014; CISA re-listed it on KEV (2024-09-17) with an EoL discontinue-use action. EPSS ~0.999 reflects sustained exploitation, historically via drive-by browser exploitation.",
@@ -100926,7 +100926,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Progress via coordinated disclosure (credited to Sina Kheirkhah of Summoning Team via Trend ZDI); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-6670 (CWE-89, CVSS 9.8) + CISA KEV (added 2024-09-16, ransomware Known) + Progress WhatsUp Gold Security Bulletin August 2024.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited and flagged by CISA KEV as ransomware-associated (ransomware: Known). EPSS is 0.947, among the highest in the batch, reflecting broad exploitation of internet-facing WhatsUp Gold monitoring servers to retrieve encrypted credentials and pivot.",
@@ -101021,7 +101021,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Peter Girnus (Trend Micro Zero Day Initiative); Microsoft confirmed prior in-the-wild exploitation by Void Banshee. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43461 (CWE-451, CVSS 8.8) + CISA KEV (added 2024-09-16) + Microsoft MSRC advisory CVE-2024-43461.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Void Banshee APT before July 2024, chained with CVE-2024-38112 to deliver Atlantida stealer. The MSHTML platform misrepresents the file extension so a malicious HTA is displayed to the victim as a benign PDF. Ransomware association is unconfirmed.",
@@ -101116,7 +101116,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Ivanti PSIRT; technical analysis and PoC by Horizon3.ai. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-8190 (CWE-78, CVSS 7.2) + CISA KEV (added 2024-09-13) + Ivanti CSA security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild within days of disclosure by a suspected nation-state actor (FortiGuard, SecurityWeek), frequently chained with the CSA auth-bypass CVE-2024-8963 to reach the admin console. CISA ransomware status Unknown.",
@@ -101210,7 +101210,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Joe Desimone (Elastic Security Labs). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38217 (CWE-693, CVSS 5.4) + CISA KEV (added 2024-09-10) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild via the 'LNK stomping' technique to strip Mark-of-the-Web tagging so downloaded files bypass Protected View/SmartScreen warnings. Added to CISA KEV 2024-09-10; Elastic Security reported evidence the technique had been abused for months before disclosure. Ransomware association: Unknown.",
@@ -101305,7 +101305,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Michael Baer (SEC Consult Vulnerability Lab) to Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38014 (CWE-269, CVSS 7.8) + CISA KEV (added 2024-09-10) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day and added to CISA KEV 2024-09-10; grants local low-privileged users SYSTEM. Commonly chained after initial access to complete host takeover.",
@@ -101393,7 +101393,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Addressed in Microsoft's September 2024 Patch Tuesday; reporter not publicly credited. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38226 (CWE-693, CVSS 7.3) + CISA KEV (added 2024-09-10) + Microsoft MSRC advisory CVE-2024-38226.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2024-09-10; attackers use it to bypass Office macro-blocking policy so untrusted files execute macros without the expected Mark-of-the-Web/protected-view warnings. No ransomware attribution is recorded, but it is a phishing-chain enabler.",
@@ -101484,7 +101484,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by SonicWall PSIRT (SNWLID-2024-0015). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40766 (CWE-284, CVSS 9.8) + CISA KEV (added 2024-09-09) + SonicWall advisory SNWLID-2024-0015.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited by Akira and Fog ransomware affiliates against internet-facing SonicWall SSL VPN/firewall management, with encryption observed in under an hour of initial access; CISA KEV flags ransomware use as Known. Post-patch migrations that failed to reset local user credentials remained exploitable.",
@@ -101581,7 +101581,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Rediscovered and reported as a security issue by Qualys (the fix commit had landed in April 2015 without being recognized as a security threat). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-1000253 (CWE-119, CVSS 7.8) + CISA KEV (added 2024-09-09, ransomware: Known) + Red Hat / upstream kernel advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-09 with a KEV ransomware flag of 'Known'; the PIE stack-clash-style corruption in load_elf_binary() gives a local attacker root and is a recurring privilege-escalation primitive in post-compromise and ransomware intrusion chains on unpatched long-term kernels.",
@@ -101677,7 +101677,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Nikolay Ermishkin (Mail.Ru Security Team) and Stewie; coordinated via the ImageMagick project. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2016-3714 (CWE-20, CVSS 8.4) + CISA KEV (added 2024-09-09) + ImageMagick project advisory / imagetragick.com.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "'ImageTragick' — added to CISA KEV 2024-09-09. ImageMagick is embedded in countless web upload pipelines, so a crafted image processed server-side yields RCE; exploited opportunistically at scale against sites that pass user uploads to ImageMagick delegates. No specific ransomware attribution.",
@@ -101770,7 +101770,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by ESET Research (Romain Dumont) while analyzing APT-C-60 activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7262 (CWE-22, CVSS 9.3) + CISA KEV (added 2024-09-03) + Kingsoft WPS Office update notes + ESET WeLiveSecurity report.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Weaponized as a one-click exploit by the South-Korea-aligned APT-C-60 espionage group: a booby-trapped spreadsheet (uploaded to VirusTotal Feb 2024) triggers promecefpluginhost.exe to load an attacker-supplied DLL, deploying the SpyGlace backdoor. No ransomware association reported.",
@@ -101864,7 +101864,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Tenable Research (TRA-2021-42). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-20124 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-09-03) + Tenable Research Advisory TRA-2021-42.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-09-03; GreyNoise and Tenable reported active exploitation of internet-exposed VigorConnect management servers, with dozens of source IPs observed reading arbitrary files as root. Ransomware use not confirmed.",
@@ -101963,7 +101963,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Tenable Research (TRA-2021-42). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-20123 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-09-03) + DrayTek VigorConnect security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV amid a global campaign against DrayTek devices; unauthenticated attackers abuse the DownloadFileServlet path traversal to read arbitrary files (e.g. credentials) as root from Internet-exposed VigorConnect management servers. Ransomware use not confirmed.",
@@ -102053,7 +102053,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google (Chrome VRP) by an external researcher; fixed in Chrome 128.0.6613.84. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7965 (CWE-787/CWE-358, CVSS 8.8) + CISA KEV (added 2024-08-28) + Google Chrome stable-channel release notes.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google acknowledged that an exploit for CVE-2024-7965 exists in the wild. Added to CISA KEV 2024-08-28; affects all Chromium-based browsers (Chrome, Edge, Opera), broadening exposure well beyond a single vendor.",
@@ -102147,7 +102147,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by SonicWall Capture Labs threat researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38856 (CWE-863, CVSS 9.8) + CISA KEV (added 2024-08-27) + Apache OFBiz security advisory (lists.apache.org).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (EPSS ~0.994, 99.9th percentile); CISA added it to KEV one day after a public PoC emerged. Unauthenticated attackers reach the ProgramExport endpoint and run Groovy for pre-auth RCE. Ransomware use not confirmed.",
@@ -102246,7 +102246,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Microsoft Threat Intelligence and the Google Chrome security team following in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7971 (CWE-843, CVSS 9.6) + CISA KEV (added 2024-08-26) + Google Chrome stable-channel update + Microsoft Citrine Sleet report.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft attributed exploitation to North Korean threat actor Citrine Sleet, who chained this V8 zero-day with a Windows sandbox-escape to deploy the FudModule rootkit against cryptocurrency targets. Actively exploited as a zero-day before the fix; ransomware not involved.",
@@ -102340,7 +102340,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "In-the-wild exploitation surfaced by Lumen Black Lotus Labs; disclosed by Versa Networks. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-39717 (CWE-434, CVSS 7.2) + CISA KEV (added 2024-08-23) + Versa Networks security bulletin + Lumen Black Lotus Labs reporting.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day since at least June 2024, attributed with moderate confidence to Chinese state-sponsored actors (Volt Typhoon / Bronze Silhouette) who deployed a memory-resident 'VersaMem' web shell against ISPs and MSPs. CISA KEV ransomware status: Unknown.",
@@ -102436,7 +102436,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Microsoft's July 2021 Exchange servicing updates (coordinated researcher reporting in the ProxyOracle/ProxyShell research wave). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-31196 (no NVD CWE; judged CWE-502, CVSS 7.2) + CISA KEV (added 2024-08-21) + Microsoft MSRC advisory CVE-2021-31196.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-21 as actively exploited. A post-authentication remote code execution flaw in Microsoft Exchange Server (part of the ProxyOracle-era Exchange bug set); operators abuse it to run code on internet-facing Exchange and drop web shells. Ransomware association is unconfirmed.",
@@ -102534,7 +102534,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by the Crusaders of Rust CTF team to upstream Linux/distros. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-0185 (CWE-190/191, CVSS 8.4) + CISA KEV (added 2024-08-21) + upstream Linux kernel Filesystem Context fix.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in 2024 after confirmed in-the-wild use; widely leveraged for local privilege escalation and container escape on Linux hosts with unprivileged user namespaces enabled. Ransomware status Unknown.",
@@ -102632,7 +102632,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Dahua PSIRT by an external researcher (bashis). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-33045 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-08-21) + Dahua PSIRT advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Broadly exploited against internet-exposed Dahua IP cameras and NVRs, including recruitment into IoT botnets; EPSS is at the 99.9th percentile. Added to CISA KEV 2024-08-21. Ransomware association: Unknown.",
@@ -102726,7 +102726,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Dahua PSIRT (advisory 957). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-33044 (CWE-287, CVSS 9.8) + CISA KEV (added 2024-08-21) + Dahua PSIRT advisory 957.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-21; EPSS ~0.999 reflects mass scanning and botnet exploitation of internet-exposed Dahua cameras and OEM-rebranded devices. No confirmed ransomware use.",
@@ -102820,7 +102820,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Jenkins by Yaniv Nizry (SonarSource). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23897 (CWE-22/CWE-27, CVSS 9.8) + CISA KEV (added 2024-08-19, ransomware Known) + Jenkins Security Advisory 2024-01-24 (SECURITY-3314).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2024-08-19 with a Known ransomware association; the near-1.0 EPSS and mass scanning reflect widespread exploitation of internet-exposed Jenkins controllers, where the arbitrary file read is chained to full RCE via leaked secrets/keys.",
@@ -102914,7 +102914,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to SolarWinds by an external researcher and published in the SolarWinds trust-center advisory. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-28986 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-08-15) + SolarWinds security advisory CVE-2024-28986.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-15 on evidence of active exploitation; SolarWinds could only reproduce it authenticated, but it is exploited in the wild against internet-facing Web Help Desk. Ransomware use not flagged in KEV.",
@@ -103004,7 +103004,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft and fixed in the August 2024 Patch Tuesday; researcher-credited disclosure, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38107 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-08-13) + Microsoft Security Update Guide advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-13 as an actively-exploited local privilege escalation; the Windows Power Dependency Coordinator use-after-free lets a local attacker reach SYSTEM and is used as a post-exploitation escalation step. Ransomware use is unconfirmed but SYSTEM-grade LPEs are common in ransomware and hands-on-keyboard intrusions.",
@@ -103186,7 +103186,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by Gen Digital researchers Luigino Camastra and Milanek. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38193 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-08-13) + Microsoft MSRC advisory CVE-2024-38193.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by North Korea's Lazarus Group to escalate to SYSTEM and install the FudModule rootkit, targeting cryptocurrency and aerospace personnel. Discovered in-the-wild by Gen Digital; no ransomware association reported.",
@@ -103281,7 +103281,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Trend Micro's Zero Day Initiative Threat Hunting team while analysing DarkGate/Water Hydra activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38213 (CWE-693, CVSS 6.5) + CISA KEV (added 2024-08-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day since March 2024 by the DarkGate operators (Water Hydra / DarkCasino), who staged payloads on WebDAV shares so copy-paste operations stripped Mark-of-the-Web, evading SmartScreen and Protected View. Added to CISA KEV 2024-08-13; no confirmed ransomware use.",
@@ -103376,7 +103376,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by AhnLab and South Korea's NCSC after in-the-wild detection of APT37 activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38178 (CWE-843, CVSS 7.5) + CISA KEV (added 2024-08-13) + MSRC advisory for CVE-2024-38178.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by North Korea's APT37 (ScarCruft/RedEyes) in June 2024 against South Korean targets via Edge's Internet Explorer (legacy WebView / JScript9) mode, delivering RokRAT through a compromised ad service. A type-confusion bypass of the prior CVE-2022-41128 patch.",
@@ -103466,7 +103466,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Coordinated disclosure via Microsoft MSRC (August 2024 Patch Tuesday). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38189 (CWE-20, CVSS 8.8) + CISA KEV (added 2024-08-13) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-08-13 as an actively-exploited Microsoft Project remote code execution flaw triggered when a victim opens a malicious Project file. Exploitation depends on the target having disabled the 'Block macros from running in Office files from the Internet' policy and Trust Center notifications.",
@@ -103558,7 +103558,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Apache OFBiz project and fixed via OFBIZ-13006. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-32113 (CWE-22, CVSS 9.8) + CISA KEV (added 2024-08-07) + Apache OFBiz issue OFBIZ-13006.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited (EPSS ~0.994, 99.9th percentile) and KEV-listed; the path-traversal flaw in the OFBiz controller is used to reach restricted endpoints and achieve remote code execution. Ransomware use not confirmed.",
@@ -103743,7 +103743,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by Code White (Nicolas Joly / researchers); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2018-0824 (CWE-502, CVSS 8.8) + CISA KEV (added 2024-08-05) + Microsoft MSRC advisory for CVE-2018-0824.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in August 2024 after in-the-wild use; the flaw (UnmarshalPwn) has been leveraged for privilege escalation and code execution, including by Chinese threat actors (e.g. Cinnamon Tempest / activity around the ChamelGang and ransomware operators). CISA KEV ransomware status: Unknown.",
@@ -103846,7 +103846,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Microsoft researchers after observing post-compromise ransomware use; disclosed with Broadcom. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-37085 (CWE-287/CWE-305, CVSS 7.2) + CISA KEV (added 2024-07-30, ransomware Known) + Broadcom advisory VMSA-2024-0013.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Flagged 'Known' for ransomware use in CISA KEV (added 2024-07-30). Microsoft observed Storm-0506, Storm-1175, Octo Tempest and Manatee Tempest abusing it post-compromise to seize domain-joined ESXi hypervisors, leading to Akira and Black Basta ransomware deployments and mass-VM encryption.",
@@ -104042,7 +104042,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Assetnote researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-5217 (CWE-184/CWE-697, CVSS 9.8) + CISA KEV (added 2024-07-29) + ServiceNow KB1648313.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in global reconnaissance campaigns; chained with CVE-2024-4879 (and CVE-2024-5178) by unauthenticated attackers to execute code and dump ServiceNow user/credential data from internet-exposed instances (~42,000 exposed at disclosure). Added to CISA KEV 2024-07-29, EPSS ~99.9th percentile. Ransomware association: Unknown per KEV.",
@@ -104138,7 +104138,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to ServiceNow; public root-cause analysis by Assetnote. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4879 (CWE-1287, CVSS 9.3) + CISA KEV (added 2024-07-29) + ServiceNow advisory KB1645154.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-29; EPSS ~0.9998 reflects mass exploitation of internet-facing Now Platform instances following public analysis. Unauthenticated RCE chained with other ServiceNow flaws for data theft. No confirmed ransomware use.",
@@ -104324,7 +104324,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered via in-the-wild attacks (December 2012 watering-hole campaigns) and analyzed by Microsoft/researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2012-4792 (CWE-416, CVSS 8.8) + CISA KEV (added 2024-07-23) + Microsoft Security Advisory 2794220 / MS13-008.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild in December 2012 via watering-hole drive-by pages (notably the Council on Foreign Relations compromise) using a CDwnBindInfo use-after-free; re-added to CISA KEV 2024-07-23. The impacted Internet Explorer is end-of-life and should be disconnected.",
@@ -104415,7 +104415,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to VMware and addressed in VMSA-2022-0009 (April 2022); researcher-credited disclosure, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-22948 (CWE-276, CVSS 6.5) + CISA KEV (added 2024-07-17) + VMware advisory VMSA-2022-0009.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-17; a non-administrative vCenter user can read sensitive files (including credentials/secrets on disk) due to incorrect default file permissions, which is valuable for privilege escalation and lateral movement within virtualization infrastructure. Ransomware use is unconfirmed but vCenter is a prime ransomware pivot.",
@@ -104511,7 +104511,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Hussein Daher (Web Immunify) to SolarWinds and fixed in Serv-U 15.4.2 Hotfix 2. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-28995 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-07-17) + SolarWinds security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "SolarWinds Serv-U directory-traversal enabling unauthenticated read of arbitrary host files. Added to CISA KEV 2024-07-17 amid mass Internet-wide scanning and exploitation (very high EPSS ~0.996) shortly after the Rapid7 write-up and public PoCs appeared. No specific ransomware attribution.",
@@ -104603,7 +104603,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe by researcher 'spacewasp'; CosmicSting exploitation analyzed by Assetnote and Sansec. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-34102 (CWE-611, CVSS 9.8) + CISA KEV (added 2024-07-17) + Adobe advisory APSB24-40.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited as 'CosmicSting' against Adobe Commerce/Magento storefronts; an unauthenticated crafted XML document triggers XXE that, chained with a PHP object-injection/file-read primitive, yields RCE and mass storefront compromise. No user interaction required; widely abused to plant skimmers and webshells.",
@@ -104701,7 +104701,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through the GeoServer/GeoTools security advisory process (GHSA-6jj6-gm7p-fcvv). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-36401 (CWE-94/CWE-95, CVSS 9.8) + CISA KEV (added 2024-07-15) + GeoServer GitHub Security Advisory GHSA-6jj6-gm7p-fcvv.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-15; near-1.0 EPSS reflects mass exploitation of internet-facing GeoServer instances, with botnets and cryptominers dropping payloads via OGC request parameters. Because the flaw affects ALL default installs, exploitation was widespread. Ransomware use not confirmed.",
@@ -104795,7 +104795,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by security researcher Arseniy Sharoglazov (Positive Technologies). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-23692 (CWE-94/CWE-1336, CVSS 9.8) + CISA KEV (added 2024-07-09) + GitHub Advisory GHSA-cw5c-xm7f-wx63.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Under broad active exploitation (EPSS ~0.99); unauthenticated attackers use HFS template/macro injection to run OS commands on Internet-exposed file servers, frequently for cryptominer and loader deployment. HFS 2.3m is end-of-life with no vendor patch.",
@@ -104885,7 +104885,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Coordinated disclosure via Microsoft MSRC (July 2024 Patch Tuesday). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38080 (CWE-190, CVSS 7.8) + CISA KEV (added 2024-07-09) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-07-09 as a zero-day in the July 2024 Patch Tuesday. A local attacker with user-level permissions can escalate to SYSTEM via a Hyper-V flaw, making it a valuable post-compromise privilege-escalation primitive.",
@@ -104978,7 +104978,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by Check Point Research (Haifei Li); campaign analysis by Check Point and Trend Micro (Void Banshee). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38112 (CWE-451, CVSS 7.5) + CISA KEV (added 2024-07-09) + Microsoft MSRC advisory for CVE-2024-38112.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Void Banshee APT to deliver the Atlantida infostealer; malicious internet-shortcut (.url) files with an mhtml handler force disabled Internet Explorer to open attacker HTML/HTA, leading to code execution. KEV-listed 2024-07-09. Ransomware use not confirmed.",
@@ -105070,7 +105070,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Sygnia during a Velvet Ant incident-response investigation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-20399 (CWE-78, CVSS 6.7) + CISA KEV (added 2024-07-02) + Cisco advisory cisco-sa-nxos-cmd-injection-xD9OhyOP.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Sygnia attributed exploitation to the China-nexus espionage group Velvet Ant, who used it as a zero-day to run custom malware on Cisco Nexus switches for persistent, low-visibility access. CISA listed it 2024-07-02; requires stolen Administrator credentials, so it functions as a stealthy escape from the CLI to root. No ransomware.",
@@ -105166,7 +105166,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Roundcube project via coordinated disclosure; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-13965 (CWE-79/CWE-80, CVSS 6.1) + CISA KEV (added 2024-06-26) + Roundcube security updates 1.4.5 and 1.3.12 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in June 2024; Roundcube webmail XSS flaws have been chained by espionage actors (e.g. Winter Vivern / APT28-style campaigns) to steal mail and session data from government and diplomatic targets. CISA KEV ransomware status: Unknown.",
@@ -105265,7 +105265,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Team Orca of Sea Security working with Trend Micro Zero Day Initiative. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-2586 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-06-26) + Red Hat / oss-security advisories.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-06-26 as actively exploited. A use-after-free in the Linux kernel nf_tables (nft_object cross-table set reference) lets a local attacker with CAP_NET_ADMIN escalate to root. Ransomware association is unconfirmed.",
@@ -105359,7 +105359,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the JAI-EXT/GeoServer projects and published as GHSA-v92f-jx6p-73rx. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-24816 (CWE-94, CVSS 10.0) + CISA KEV (added 2024-06-26) + GitHub Security Advisory GHSA-v92f-jx6p-73rx.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV after in-the-wild exploitation against GeoServer, which bundles the vulnerable jt-jiffle; on a default install the Jiffle-backed WPS endpoint is reachable unauthenticated, giving unauth RCE. EPSS ~0.99. Ransomware status Unknown.",
@@ -105454,7 +105454,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Progress by Soroush Dalili and Sina Kheirkhah. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4358 (CWE-290, CVSS 9.8) + CISA KEV (added 2024-06-13) + Progress Telerik advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild, typically chained with CVE-2024-1800 (deserialization) to achieve unauthenticated remote code execution on Telerik Report Server; public exploitation followed rapidly after disclosure. Added to CISA KEV 2024-06-13, EPSS ~99.9th percentile. Ransomware association: Unknown.",
@@ -105548,7 +105548,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft; in-the-wild tool analyzed by Symantec Threat Hunter Team. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-26169 (CWE-269, CVSS 7.8) + CISA KEV (added 2024-06-13) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Ransomware-linked: Symantec attributed an exploit tool for this flaw to the Cardinal/Storm-1811 group behind Black Basta, with build timestamps predating the patch (likely zero-day). Added to CISA KEV 2024-06-13.",
@@ -105638,7 +105638,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and fixed by Google in the June 2024 Pixel/Android Security Bulletin. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-32896 (CWE-670/CWE-783, CVSS 7.8) + CISA KEV (added 2024-06-13) + Android Pixel Security Bulletin 2024-06-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google warned in June 2024 that this Pixel firmware/Android Framework flaw was under limited, targeted exploitation as a zero-day, consistent with forensic/spyware tooling that chains a local privilege escalation to defeat device protections. No ransomware association is recorded.",
@@ -105732,7 +105732,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by DEVCORE (Orange Tsai); patched by the PHP Group. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4577 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-06-12) + PHP Group release notes for 8.1.29/8.2.20/8.3.8.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited in the wild since disclosure (June 2024) against Windows Apache + PHP-CGI, used by multiple actors and ransomware operators for arbitrary code execution and source disclosure; EPSS ~0.9999 and CISA KEV flags ransomware use as Known. This is a Best-Fit code-page bypass of the older CVE-2012-1823 fix.",
@@ -105825,7 +105825,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by Arm in its Mali GPU driver security bulletin with acknowledgement of in-the-wild exploitation; researcher/vendor-credited, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4610 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-06-12) + Arm Mali GPU Kernel Driver security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Arm confirmed there are indications this use-after-free is being exploited in the wild; added to CISA KEV 2024-06-12. Because Bifrost/Valhall Mali GPU drivers ship in a very large population of Android devices, a local non-privileged app can leverage it for privilege escalation / sandbox escape. Ransomware flag is Unknown; the class is favored by mobile spyware / targeted implant chains.",
@@ -105917,7 +105917,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Oracle and fixed in the April 2017 Critical Patch Update; the WLS-WSAT research is credited to security researchers (e.g. via Oracle PSIRT). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2017-3506 (CWE-78, CVSS 7.4) + CISA KEV (added 2024-06-03) + Oracle Critical Patch Update April 2017.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Oracle WebLogic Server Web Services (WLS-WSAT) OS command injection via a crafted SOAP/XML HTTP request. Added to CISA KEV 2024-06-03; the WLS-WSAT vector (shared with CVE-2017-10271) has been abused for years by cryptomining and access-broker actors against internet-facing WebLogic. No specific ransomware attribution.",
@@ -106013,7 +106013,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by researcher Mingi Cho (Theori); public exploit by Notselwyn. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-1086 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-05-30, ransomware Known) + upstream kernel fix commit f342de4e2f33.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA flags known ransomware use: a local attacker exploits the nf_tables use-after-free to gain root on unpatched Linux hosts. A widely-shared public exploit makes it a reliable post-compromise privilege-escalation primitive across many distributions.",
@@ -106207,7 +106207,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Rapid7 during an incident investigation; JAVS pulled the affected installer. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4978 (CWE-506, CVSS 8.7) + CISA KEV (added 2024-05-29) + Rapid7 R7 disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A trojanized JAVS Viewer 8.3.7 installer distributed through the vendor's software supply chain shipped a malicious binary (fffmpeg.exe) that opens a C2 backdoor and runs unauthorized PowerShell. Confirmed in-the-wild supply-chain compromise; affected hosts require full reimage, not just software update.",
@@ -106391,7 +106391,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Apache Flink project and fixed in commit b561010b (released 1.11.3/1.12.0). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-17519 (CWE-552, CVSS 7.5) + CISA KEV (added 2024-05-23) + Apache Flink security advisory (lists.apache.org).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited and mass-scanned (EPSS ~0.978); attackers read arbitrary files (e.g. configuration, credentials, /etc/passwd) from the Flink JobManager host via its REST interface. Frequently used against internet-exposed Flink dashboards. Ransomware use not confirmed.",
@@ -106484,7 +106484,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by Kaspersky (Boris Larin, Vasily Berdnikov, Mert Degirmenci) after in-the-wild detection. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4947 (CWE-843, CVSS 9.6) + CISA KEV (added 2024-05-20) + Google Chrome stable-channel update.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Reported by Kaspersky and confirmed by Google as exploited in the wild; the campaign used a fake blockchain/game website to deliver the V8 exploit. CISA listed it 2024-05-20. Actively exploited as a zero-day; ransomware not involved.",
@@ -106579,7 +106579,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Horizon3.ai (Naveen Sunkavally); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-43208 (CWE-78/CWE-502, CVSS 9.8) + CISA KEV (added 2024-05-20, ransomware Known) + Horizon3.ai research + NextGen Healthcare Mirth Connect 4.4.1.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in May 2024 and flagged ransomware-associated (ransomware: Known); unauthenticated RCE in Mirth Connect has been mass-exploited against healthcare integration servers for initial access and ransomware staging. EPSS 0.83.",
@@ -106671,7 +106671,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google's Chrome security team; Google credited the reporter anonymously and confirmed in-the-wild exploitation. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4761 (CWE-787, CVSS 8.8) + CISA KEV (added 2024-05-16) + Google Chrome Releases advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google acknowledged an exploit exists in the wild and shipped an emergency fix (Chrome 124.0.6367.207). An out-of-bounds write in the V8 JavaScript engine is triggered by a crafted HTML page; it affects all Chromium-based browsers (Chrome, Edge, Opera, Brave). Ransomware association is unconfirmed.",
@@ -106764,7 +106764,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed with a PoC against DIR-605 B2 firmware. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2021-40655 (CWE-863, CVSS 7.5) + CISA KEV (added 2024-05-16) + D-Link security bulletin.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in 2024 amid active exploitation of legacy D-Link routers; attackers forge an unauthenticated POST to /getcfg.php to read the device username and password. Affected hardware is EoL/EoS with no fix. Ransomware status Unknown.",
@@ -106858,7 +106858,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by an independent researcher (2014). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-100005 (CWE-352, CVSS 8.0) + CISA KEV (added 2024-05-16) + D-Link advisory SAP10018.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited against internet-exposed legacy D-Link DIR-600 routers to hijack administrator sessions and change router configuration (create admin accounts, enable remote management). All affected hardware revisions are end-of-life; CISA directs retirement/replacement rather than patching. Added to CISA KEV 2024-05-16. Ransomware association: Unknown.",
@@ -106951,7 +106951,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft (credited to anonymous / vendor researchers). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-30040 (CWE-20, CVSS 8.8) + CISA KEV (added 2024-05-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild via crafted documents and added to CISA KEV 2024-05-14; the bypass defeats MSHTML/OLE mitigations to load malicious content when a user opens a lure file. No confirmed ransomware attribution.",
@@ -107043,7 +107043,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by researchers at Kaspersky, DBAPPSecurity, Google Threat Analysis Group and others after discovery amid QakBot activity. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-30051 (CWE-122/CWE-787, CVSS 7.8) + CISA KEV (added 2024-05-14, ransomware Known) + Microsoft MSRC advisory CVE-2024-30051.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "A Windows zero-day patched on 2024-05-14 and abused by QakBot operators (observed May-September 2024) to escalate to SYSTEM; CISA lists a Known ransomware association. The high EPSS and multiple public PoCs indicate broad exploitation potential.",
@@ -107136,7 +107136,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by an anonymous researcher; addressed in the Chrome Stable channel update. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4671 (CWE-416, CVSS 9.6) + CISA KEV (added 2024-05-13) + Google Chrome releases blog (Stable channel update, 2024-05-09).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a Chrome zero-day (Google acknowledged an exploit exists) before the 124.0.6367.201 fix; the Visuals use-after-free is used from a renderer-compromised context to attempt a sandbox escape. No ransomware attribution in KEV.",
@@ -107230,7 +107230,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to GitLab via its HackerOne bug-bounty program and fixed in the January 2024 security release; researcher-credited, no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-7028 (CWE-640, CVSS 9.8) + CISA KEV (added 2024-05-01) + GitLab security release (issue 436084).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-05-01; a very high-EPSS (top-percentile) unauthenticated account-takeover flaw that lets an attacker send GitLab password-reset emails to an attacker-controlled unverified address. Widely mass-exploited against internet-facing GitLab instances; compromise of a GitLab account/instance is a supply-chain and source-theft risk. Ransomware flag Unknown.",
@@ -107329,7 +107329,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Peter Girnus and Dustin Childs of Trend Micro's Zero Day Initiative, who observed in-the-wild use by Water Hydra. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29988 (CWE-693, CVSS 8.8) + CISA KEV (added 2024-04-30) + Microsoft MSRC update guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft SmartScreen prompt / Mark-of-the-Web bypass exploited in the wild as a zero-day; Trend Micro ZDI attributed use to the Water Hydra actor delivering DarkMe malware to financial traders. It is chained with CVE-2023-38831 (WinRAR) and CVE-2024-21412 to run a malicious file without a SmartScreen warning. Added to CISA KEV 2024-04-30. No ransomware attribution.",
@@ -107423,7 +107423,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by CrushFTP and analyzed by Airbus CERT / Rapid7 / CrowdStrike. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-4040 (CWE-1336/CWE-94, CVSS 10.0) + CISA KEV (added 2024-04-24) + CrushFTP update advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing CrushFTP servers: an unauthenticated attacker abuses server-side template injection to escape the VFS sandbox, read arbitrary files, bypass authentication for admin access, and achieve RCE. Reported targeting of US organizations in a coordinated campaign; no confirmed ransomware tie.",
@@ -107704,7 +107704,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Microsoft by the U.S. National Security Agency (NSA); GooseEgg exploitation analyzed and published by Microsoft Threat Intelligence. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-38028 (no NVD CWE; judged CWE-269, CVSS 7.8) + CISA KEV (added 2024-04-23) + Microsoft Security Blog GooseEgg / Forest Blizzard analysis (2024-04-22).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild by the Russian state actor Forest Blizzard (APT28/STRONTIUM) using a custom post-compromise tool named GooseEgg, as detailed by Microsoft Threat Intelligence in April 2024. The tool modifies a Print Spooler JavaScript constraints file and executes it with SYSTEM permissions to launch further tooling. Added to CISA KEV 2024-04-23.",
@@ -107802,7 +107802,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered during incident response by Volexity (UTA0218) and analyzed by Palo Alto Networks Unit 42. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-3400 (CWE-77/CWE-20, CVSS 10.0) + CISA KEV (added 2024-04-12, ransomware Known) + Palo Alto Networks advisory (security.paloaltonetworks.com/CVE-2024-3400).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day (Operation MidnightEclipse / UTA0218) to drop the UPSTYLE Python backdoor; CISA flags known ransomware use. EPSS ~1.0. Unauthenticated attackers gain root code execution on internet-facing PAN-OS firewalls, making it a top-priority mass-exploited flaw.",
@@ -107898,7 +107898,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by researcher 'netsecfish' (VDB-259284) with the exploit released to the public. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-3273 (CWE-77, CVSS 9.8) + CISA KEV (added 2024-04-11) + D-Link SAP10383.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited in the wild within days of disclosure: GreyNoise and Shadowserver observed Mirai-botnet operators sending exploit requests across ~92,000 internet-exposed D-Link NAS devices. Chained with the CVE-2024-3272 hardcoded backdoor account for unauthenticated RCE on EoL hardware. No ransomware, but commodity botnet takeover.",
@@ -107991,7 +107991,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by researcher 'netsecfish' (VDB-259283); D-Link confirmed the products are end-of-life. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-3272 (CWE-798, CVSS 9.8) + CISA KEV (added 2024-04-11) + D-Link security announcement SAP10383.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited on internet-exposed, end-of-life D-Link NAS devices; combined with CVE-2024-3273 for hardcoded-credential authenticated command injection, it was rapidly incorporated into botnet (e.g. Mirai-variant) campaigns after public disclosure. EPSS 0.98. CISA KEV ransomware status: Unknown.",
@@ -108087,7 +108087,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google by the GrapheneOS project; fixed in the April 2024 Pixel update. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29748 (CWE-755/CWE-280, CVSS 7.8) + CISA KEV (added 2024-04-04) + Android Pixel security bulletin 2024-04-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-04-04 as actively exploited. A logic error in Android/Pixel lets a local attacker interrupt a factory reset triggered by a device-admin app, escalating privilege; it was reportedly leveraged by mobile forensic-extraction tooling to defeat device-wipe protections. Ransomware association is unconfirmed.",
@@ -108175,7 +108175,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Google (Android/Pixel security) with GrapheneOS analysis of the fastboot memory-reset gap. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29745 (CWE-908, CVSS 5.5) + CISA KEV (added 2024-04-04) + Android Pixel security bulletin 2024-04-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Google flagged limited, targeted exploitation; forensic firms reboot Pixel (and other) devices in the After-First-Unlock state into fastboot mode to dump uninitialized memory and recover data protected by the lock screen. Requires physical access. Ransomware status Unknown.",
@@ -108269,7 +108269,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Nguyen Tien Giang (Jang) of STAR Labs at Pwn2Own Vancouver 2023. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-24955 (CWE-94, CVSS 7.2) + CISA KEV (added 2024-03-26) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild and flagged by CISA KEV as associated with ransomware campaigns; commonly chained with CVE-2023-29357 (auth bypass) to reach unauthenticated RCE on SharePoint Server. Originally demonstrated at Pwn2Own Vancouver 2023 by STAR Labs. Added to CISA KEV 2024-03-26. Ransomware association: Known.",
@@ -108364,7 +108364,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by independent researcher (Applied Risk / Gjoko Krstic). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2019-7256 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-03-25) + Nice/Linear eMerge E3 vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2024-03-25; EPSS ~0.97 reflects long-running mass exploitation by IoT botnets (including Mirai variants) against internet-exposed eMerge E3 access-control panels. Preauth RCE with no user interaction.",
@@ -108457,7 +108457,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by security researcher Jakub Kramarz; addressed in Ivanti advisory SA-2021-12-02. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-44529 (CWE-94, CVSS 9.8) + CISA KEV (added 2024-03-25, ransomware Known) + Ivanti advisory SA-2021-12-02.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added it to KEV on 2024-03-25 with a Known ransomware association; the near-1.0 EPSS and available Metasploit/exploit-db modules reflect active exploitation of internet-facing Ivanti EPM CSA appliances, giving unauthenticated attackers a code-execution foothold as the 'nobody' user.",
@@ -108550,7 +108550,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Fortinet by Microsoft researchers and published as FG-IR-24-007. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-48788 (CWE-89, CVSS 9.8) + CISA KEV (added 2024-03-25) + Fortinet PSIRT advisory FG-IR-24-007.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing FortiClient EMS; an unauthenticated SQL injection reaches OS command execution as SYSTEM (via MSSQL xp_cmdshell), and CISA KEV flags ransomware use as Known. EPSS ~0.976.",
@@ -108645,7 +108645,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported privately to Balbooa by researcher Phil Taylor; Balbooa shipped the fix (2.4.1) the day after the report. No AI tooling credited in discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56291 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-10) + Balbooa Forms changelog.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day before Balbooa shipped a fix; CISA added it to KEV on 2026-07-10 citing active exploitation against unpatched Balbooa Forms installs on Joomla sites. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108737,7 +108737,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to iCagenda maintainers via coordinated disclosure; the specific researcher is not publicly credited in the vendor changelog. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-48939 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-10) + iCagenda 4.0.8 changelog.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2026-07-10 alongside the Balbooa Forms flaw, citing active exploitation of Joomla sites running vulnerable iCagenda versions. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108830,7 +108830,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported via coordinated disclosure; the specific researcher is not publicly credited in Joomlack's patch notes. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-56290 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-07) + Joomlack forum patch announcement.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2026-07-07 (due date 2026-07-10) citing active exploitation; multiple reports describe webshells being planted on connected Joomla sites through the flaw. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -108924,7 +108924,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Langflow AI via GitHub Security Advisory coordinated disclosure; the specific researcher is not named in the public advisory. No AI tooling credited with discovery (the in-the-wild attack itself uses an LLM prompt-injection payload as its exploitation technique, which is distinct from AI-assisted vulnerability discovery).",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-55255 (CWE-639, CVSS 8.4) + CISA KEV (added 2026-07-07) + Langflow GHSA-qrpv-q767-xqq2 + Sysdig exploitation analysis.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Sysdig Threat Research observed the first confirmed in-the-wild exploitation on 2026-06-25 from a single operator who enumerated flow IDs and executed victims' Langflow flows to exfiltrate embedded API keys via a prompt-injection payload. CISA added it to KEV on 2026-07-07. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -109018,7 +109018,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "First publicly flagged by a JoomShaper forum user (\"[URGENT] Potential Security Vulnerability Identified\") before formal CVE coordination. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-48908 (CWE-434, CVSS 9.8) + CISA KEV (added 2026-07-07) + JoomShaper forum advisory thread.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Live attacks have been traced in Joomla access logs: an unauthenticated POST to the uploadCustomIcon task, followed by a GET to the planted PHP file, followed by creation of a rogue Super User account. CISA added it to KEV on 2026-07-07. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -109112,7 +109112,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Adobe via coordinated disclosure and patched in APSB26-68; the original discovering researcher is not named in the advisory. WatchTowr Labs' subsequent public technical analysis (not the original report) is what enabled rapid in-the-wild reproduction. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2026-48282 (CWE-22, CVSS 10.0) + CISA KEV (added 2026-07-07) + Adobe Security Bulletin APSB26-68.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "KEVIntel honeypots recorded the first in-the-wild exploitation attempt within roughly two hours of the WatchTowr technical write-up going public on 2026-07-06, reading C:\\Windows\\win.ini as a canary. CISA added it to KEV on 2026-07-07 (due 2026-07-10); Canadian and Belgian national CERTs also issued alerts. Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -109206,7 +109206,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Craft CMS (Pixel & Tonic) via coordinated disclosure; the specific researcher is not publicly credited. No AI tooling credited with discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-23209 (CWE-94, CVSS 8.0) + CISA KEV (added 2025-02-20) + Craft CMS GHSA-x684-96hh-833x.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2025-02-20, confirming active exploitation, though no public incident report has described the specific attack chain. Exploitation requires the installation's security key to already be compromised, so observed abuse is likely chained after a separate initial-access flaw (e.g. Craft's own knowledge base references the related CVE-2025-32432 asset-transform RCE as a plausible key-leaking precursor). Ransomware use is not confirmed (KEV flags it Unknown).",
@@ -109301,7 +109301,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Palo Alto Networks PSIRT; the nginx/Apache path-confusion technique was publicly detailed by independent researchers (SL Cyber). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-0108 (CWE-306, CVSS 9.1) + CISA KEV (added 2025-02-18) + Palo Alto Networks security advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Palo Alto confirmed active exploitation within days of disclosure (Feb 2025); GreyNoise/Shadowserver observed mass scanning and exploitation attempts against internet-exposed PAN-OS management interfaces, frequently chained with CVE-2024-9474 (command injection) for full RCE.",
@@ -109396,7 +109396,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through SonicWall PSIRT; the exploit technique was reverse-engineered and publicly detailed by Bishop Fox researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-53704 (CWE-287, CVSS 9.8) + CISA KEV (added 2025-02-18, ransomware use confirmed) + SonicWall PSIRT advisory SNWLID-2025-0003.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild within days of Bishop Fox publishing a public PoC (Feb 10, 2025); CISA KEV flags confirmed ransomware use — responders observed exploitation tied to intrusions that hijacked active SSL VPN sessions for initial access.",
@@ -109489,7 +109489,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed through Horizon3.ai's Attack Research team and confirmed by the SimpleHelp vendor KB advisory. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-57727 (CWE-22, CVSS 7.5) + CISA KEV (added 2025-02-13, ransomware use confirmed) + SimpleHelp KB security advisory + CISA advisory AA25-163A.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited since January 2025 by ransomware affiliates (DragonForce) as an initial-access vector against unpatched SimpleHelp servers, most notably a utility billing software provider per CISA advisory AA25-163A; CISA KEV flags confirmed ransomware use.",
@@ -109580,7 +109580,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Bill Marczak of The Citizen Lab (University of Toronto's Munk School). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-24200 (CWE-863, CVSS 6.1) + CISA KEV (added 2025-02-12) + Apple security advisories (support.apple.com/en-us/122173, 122174, 122345, 122346).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple confirmed the flaw was exploited in 'an extremely sophisticated attack against specific targeted individuals' — consistent with forensic-extraction tooling (GrayKey/Cellebrite-class hardware) used to defeat USB Restricted Mode on a physically seized, locked device. Not mass-exploited; no ransomware association.",
@@ -109675,7 +109675,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Mitel's coordinated disclosure process (Product Security Advisory 24-0019). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-41710 (CWE-88, CVSS 7.2) + CISA KEV (added 2025-02-12) + Mitel Product Security Advisory 24-0019.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA KEV-listed for confirmed active exploitation; the public GitHub PoC documents chaining administrative access to the phone's management interface with the argument-injection flaw in the boot process to achieve command execution. No ransomware association reported.",
@@ -109938,7 +109938,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by VulnCheck security researchers; active in-the-wild exploitation identified and reported by GreyNoise. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40891 (CWE-78, CVSS 8.8) + CISA KEV (added 2025-02-11) + Zyxel security advisory (2025-02-04).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "GreyNoise observed mass scanning and exploitation attempts against exposed Zyxel legacy DSL CPE devices beginning January 2025; Mirai botnet variants incorporated exploitation of this Telnet-based command injection shortly after, using it (alongside CVE-2024-40890) to recruit EOL routers into botnet infrastructure. Ransomware association is not confirmed (KEV flags ransomware use as Unknown).",
@@ -110031,7 +110031,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed by VulnCheck security researchers alongside CVE-2024-40891; active in-the-wild exploitation identified and reported by GreyNoise. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40890 (CWE-78, CVSS 8.8) + CISA KEV (added 2025-02-11) + Zyxel security advisory (2025-02-04).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Part of the same active-exploitation campaign as CVE-2024-40891: GreyNoise and Mirai botnet trackers observed mass scanning/exploitation of exposed Zyxel legacy DSL CPE devices via crafted HTTP POST requests against the CGI management program beginning January 2025. Ransomware association is not confirmed (KEV flags ransomware use as Unknown).",
@@ -110131,7 +110131,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified through active-exploitation incident response and reported by Trimble in coordination with CISA. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2025-0994 (CWE-502, CVSS 8.8) + CISA KEV (added 2025-02-07) + Trimble customer advisory (2025-02-05) + CISA ICS advisory ICSA-25-037-04.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited as a zero-day beginning around January 2025 against internet-facing Cityworks/IIS deployments at local-government and utility operators; Trimble-shared IOCs indicate attackers deployed custom Rust-based loaders to stage the VShell and Cobalt Strike post-exploitation frameworks in memory. No ransomware payload confirmed (KEV flags ransomware use as Unknown), but the affected sectors span water/wastewater, energy, and transportation.",
@@ -110224,7 +110224,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified in the wild by Trend Micro's Zero Day Initiative (ZDI) Threat Hunting team (September 2024) and disclosed to 7-Zip author Igor Pavlov as ZDI-CAN-25456. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-0411 (CWE-693, CVSS 7.0) + CISA KEV (added 2025-02-06) + Zero Day Initiative advisory ZDI-25-045.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day since at least September 2024 by Russian cybercrime groups in a SmokeLoader malware campaign (identified by Trend Micro ZDI Threat Hunting) targeting at least nine Ukrainian government and municipal entities via spear-phishing with homoglyph-spoofed double-encapsulated archives. Ransomware is not confirmed for this campaign (KEV flags ransomware use as Unknown); the assessed intent is cyberespionage tied to the Russia-Ukraine conflict.",
@@ -110317,7 +110317,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Check Point Research; patched by Microsoft in the February 2024 Patch Tuesday release. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-21413 (CWE-20, CVSS 9.8) + CISA KEV (added 2025-02-06) + Microsoft MSRC advisory (2024-02-13).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in February 2025 confirming in-the-wild exploitation of this critical (CVSS 9.8) Outlook flaw; EPSS scores it at the 99.8th percentile, indicating near-certain continued exploitation attempts. No ransomware association confirmed (KEV flags ransomware use as Unknown), but the bug's ability to bypass Protected View and leak NTLM credentials makes it attractive for both espionage and commodity intrusion.",
@@ -110410,7 +110410,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Check Point Research (CPR-Zero, CPRID-2193); disclosed to and patched by Audinate. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2022-23748 (CWE-114, CWE-426, CVSS 7.8) + CISA KEV (added 2025-02-06) + Audinate vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV in February 2025, confirming observed in-the-wild exploitation; a low-complexity local DLL side-loading technique against the mDNSResponder.exe component bundled with Audinate's Dante Application Library for Windows, used across pro-audio and broadcast production environments. No ransomware association documented (KEV flags ransomware use as Unknown).",
@@ -110503,7 +110503,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and fixed by Sophos (Cyberoam's parent company) via a hotfix issued December 4, 2020. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-29574 (CWE-89, CVSS 9.8) + CISA KEV (added 2025-02-06) + Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqli (2020-12-10).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Listed in CISA KEV confirming active in-the-wild exploitation of unauthenticated SQL injection against the CyberoamOS WebAdmin interface; on some compromised systems this was used to create unrecognized administrative accounts. CISA's record marks ransomware campaign use as Known, and the product is end-of-life/end-of-service per CISA's required action.",
@@ -110879,7 +110879,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The ObjRef-leak-to-RCE technique against .NET Remoting over HTTP was publicly researched and detailed by codewhitesec; Microsoft patched the underlying information-disclosure flaw. No AI tooling credited.",
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29059 (CWE-209, CVSS 7.5) + CISA KEV (added 2025-02-04) + Microsoft Security Response Center advisory (msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since late 2024/early 2025: attackers send crafted HTTP requests to a vulnerable .NET Remoting-over-HTTP endpoint to leak an ObjRef URI, then use that leaked object reference to open a raw remoting channel and achieve deserialization-based remote code execution. EPSS is 0.986 (99.9th percentile); added to CISA KEV Feb 2025.",
@@ -111267,7 +111267,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to SonicWall PSIRT following Microsoft Threat Intelligence Center (MSTIC) notification of active exploitation; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-23006 (CWE-502, CVSS 9.8) + CISA KEV (added 2025-01-24) + SonicWall PSIRT advisory SNWLID-2025-0002.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Microsoft Threat Intelligence Center notified SonicWall of possible active exploitation of this pre-auth deserialization flaw as a zero-day before the January 22, 2025 hotfix; CISA added it to KEV two days later flagging known ransomware use. Threat actors later chained it with CVE-2025-40602 to obtain full root-level RCE on SMA1000 appliances.",
@@ -111452,7 +111452,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Aviatrix PSIRT via standard vulnerability disclosure; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-50603 (CWE-78, CVSS 10.0) + CISA KEV (added 2025-01-16) + Aviatrix PSIRT advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild from January 7-10, 2025, with a sharp surge after a public Nuclei detection template was released; threat actors used unauthenticated command injection to deploy XMRig cryptominers and Sliver C2 backdoors for persistence. Not flagged for ransomware by CISA KEV, but Wiz Research notes 65% of organizations running Aviatrix Controller have a lateral-movement path to administrative cloud control-plane permissions.",
@@ -111547,7 +111547,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Microsoft via MSRC; Microsoft's advisory credits standard vulnerability research channels. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-21335 (CWE-416, CVSS 7.8) + CISA KEV (added 2025-01-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One of three Windows Hyper-V NT Kernel Integration VSP memory-corruption elevation-of-privilege flaws (alongside CVE-2025-21333 and CVE-2025-21334) patched in Microsoft's January 2025 Patch Tuesday; Microsoft confirmed exploitation in the wild at time of disclosure. Used as a local privilege-escalation step to reach SYSTEM after initial host or guest access. Not flagged for ransomware.",
@@ -111638,7 +111638,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Microsoft via MSRC; Microsoft's advisory credits standard vulnerability research channels. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-21334 (CWE-416, CVSS 7.8) + CISA KEV (added 2025-01-14) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One of three Windows Hyper-V NT Kernel Integration VSP memory-corruption elevation-of-privilege flaws (alongside CVE-2025-21333 and CVE-2025-21335) patched in Microsoft's January 2025 Patch Tuesday; Microsoft confirmed exploitation in the wild at time of disclosure. Used as a local privilege-escalation step to reach SYSTEM after initial host or guest access. Not flagged for ransomware.",
@@ -111729,7 +111729,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Microsoft via MSRC; Microsoft's advisory credits standard vulnerability research channels. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2025-21333 (CWE-122, CVSS 7.8) + CISA KEV (added 2025-01-14) + Microsoft MSRC advisory + Exploit-DB 52436.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "One of three Windows Hyper-V NT Kernel Integration VSP memory-corruption elevation-of-privilege flaws (alongside CVE-2025-21334 and CVE-2025-21335) patched in Microsoft's January 2025 Patch Tuesday; Microsoft confirmed exploitation in the wild at time of disclosure. Used as a local privilege-escalation step to reach SYSTEM after initial host or guest access. Not flagged for ransomware.",
@@ -112114,7 +112114,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by watchTowr Labs (Sonny Macdonald) as a zero-day during MiCollab research and subsequently assigned a CVE by Mitel; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-55550 (CWE-22, CVSS 2.7) + CISA KEV (added 2025-01-07) + Mitel MISA-2024-0029.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Chained with CVE-2024-41713 in live exploitation against internet-facing MiCollab servers around the December 2024 disclosure window. CISA KEV flags a ransomware association for this entry.",
@@ -112207,7 +112207,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and publicly disclosed by watchTowr Labs (Sonny Macdonald); no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-41713 (CWE-22, CVSS 9.1) + CISA KEV (added 2025-01-07) + Mitel MISA-2024-0029.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild, frequently chained with CVE-2024-55550, against internet-facing MiCollab NuPoint Unified Messaging endpoints shortly after watchTowr's December 2024 disclosure. CISA KEV flags a ransomware association for this entry.",
@@ -113240,7 +113240,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and patched by Adobe via APSB24-14. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-20767 (CWE-284, CVSS 7.4) + CISA KEV (added 2024-12-16) + Adobe APSB24-14.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2024-12-16 (due 2025-01-06) citing in-the-wild use against internet-exposed ColdFusion admin panels to read arbitrary files, including credential/config files. Ransomware association is Unknown.",
@@ -113334,7 +113334,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified through active-exploitation telemetry (Huntress, watchTowr Labs) and reported to Cleo. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-50623 (CWE-434, CVSS 9.8) + CISA KEV (added 2024-12-13, ransomware: Known) + Cleo Product Security Advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited from early December 2024 (activity dating to Dec 3, spiking Dec 8) by a Termite-affiliated ransomware actor; at least ten businesses' Cleo servers were confirmed compromised via arbitrary file write leading to RCE. CISA KEV flags ransomware use as Known.",
@@ -113431,7 +113431,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered/reported by CrowdStrike; observed exploited in the wild and confirmed by Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-49138 (CWE-122, CVSS 7.8) + CISA KEV (added 2024-12-10) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day before the December 2024 Patch Tuesday fix; discovered/reported by CrowdStrike. CLFS driver flaws are a recurring precursor used by ransomware affiliates to reach SYSTEM before domain-wide ransomware deployment; this is the fifth actively-exploited CLFS LPE since 2022.",
@@ -113523,7 +113523,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed via a researcher blog post and exploited in the wild by the PSAUX actor within days of disclosure. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-51378 (CWE-78, CVSS 10.0) + CISA KEV (added 2024-12-04, ransomware: Known) + CyberPanel patch commit 1c0c6cb.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited within days of disclosure by the PSAUX ransomware campaign in October 2024, compromising roughly 22,000 internet-facing CyberPanel instances by chaining the HTTP-verb auth bypass with shell metacharacter injection.",
@@ -113618,7 +113618,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Synacktiv researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-11680 (CWE-306, CVSS 9.8) + CISA KEV (added 2024-12-03) + Synacktiv technical advisory + ProjectSend patch commit 193367d.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since mid-2024; VulnCheck and honeypot telemetry observed mass scanning and exploitation of internet-facing ProjectSend instances to plant webshells and stored XSS payloads ahead of CISA's KEV addition.",
@@ -113711,7 +113711,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to and disclosed by Zyxel via vendor advisory; exploited by Helldown ransomware affiliates. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-11667 (CWE-22, CVSS 7.5) + CISA KEV (added 2024-12-03, ransomware: Known) + Zyxel security advisory (2024-11-27).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Used as an initial-access vector by the Helldown ransomware group from around November-December 2024 to compromise internet-exposed Zyxel firewall/VPN management interfaces before deploying ransomware into victim networks. CISA KEV flags ransomware use as Known.",
@@ -113803,7 +113803,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed via Japan's JVN coordinated-disclosure process. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-45727 (CWE-611, CVSS 7.5) + CISA KEV (added 2024-12-03) + JVN#95981460 + North Grid vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV on 2024-12-03 citing confirmed in-the-wild exploitation; Japan's coordinated-disclosure process (JVN) and the vendor confirm real-world attacks reading account information via crafted XML requests. Ransomware association is Unknown.",
@@ -113900,7 +113900,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Array Networks in March 2023; later confirmed under active exploitation by the China-linked group Earth Kasha per CISA/SecurityWeek reporting. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2023-28461 (CWE-287/CWE-306, CVSS 9.8) + CISA KEV (added 2024-11-25) + Array Networks vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild by the China-linked espionage group Earth Kasha for initial access into target networks; CISA KEV flags this entry with a known history of ransomware-actor use.",
@@ -114269,7 +114269,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Broadcom/VMware; active in-the-wild exploitation attributed to UNC5221 by Mandiant. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38813 (CWE-250/CWE-273, CVSS 7.5) + CISA KEV (added 2024-11-20) + Broadcom VMSA-2024-0019 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild, attributed by Mandiant to the China-linked threat actor UNC5221 targeting critical infrastructure; frequently chained with CVE-2024-38812 to convert initial remote code execution into full root-level control of vCenter Server.",
@@ -114363,7 +114363,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Broadcom/VMware; active in-the-wild exploitation attributed to UNC5221 by Mandiant, following rapid public PoC release. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38812 (CWE-122/CWE-787, CVSS 9.8) + CISA KEV (added 2024-11-20) + Broadcom VMSA-2024-0019 advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; attributed by Mandiant to the China-linked threat actor UNC5221 targeting critical infrastructure. Public PoC code emerged on GitHub within 48 hours of Broadcom's advisory, and confirmed real-world exploitation followed within days.",
@@ -114458,7 +114458,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by Palo Alto Networks; Unit 42 confirmed in-the-wild mass exploitation chained with CVE-2024-0012. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9474 (CWE-78, CVSS 7.2) + CISA KEV (added 2024-11-18) + Palo Alto Networks security advisory + Unit 42 research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild, chained with CVE-2024-0012 (PAN-OS management-interface authentication bypass) for unauthenticated root-level command execution on internet-exposed firewalls; CISA KEV flags known ransomware-actor use, and Palo Alto Networks/Unit 42 confirmed mass exploitation against devices with an internet-facing management interface.",
@@ -114555,7 +114555,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by Rhino Security Labs. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-1212 (CWE-78, CVSS 10.0) + CISA KEV (added 2024-11-18) + Progress/Kemp vendor advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since at least April 2024 via the unauthenticated LoadMaster management web interface; CISA added it to KEV on 2024-11-18. Post-exploitation attackers escalate from the default 'bal' admin account to root by abusing sudo entries.",
@@ -114752,7 +114752,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Zach Hanley of Horizon3.ai. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9465 (CWE-89, CVSS 9.1) + CISA KEV (added 2024-11-14) + Palo Alto Networks PAN-SA-2024-0010.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; Palo Alto Networks confirmed evidence of active exploitation alongside CVE-2024-9463, prompting CISA KEV addition on 2024-11-14.",
@@ -114846,7 +114846,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by the Horizon3.ai research team as part of the Expedition vulnerability chain. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9463 (CWE-78, CVSS 7.5) + CISA KEV (added 2024-11-14) + Palo Alto Networks PAN-SA-2024-0010.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; CISA confirmed evidence of exploitation and added the flaw to KEV on 2024-11-14 alongside CVE-2024-9465. Public exploit code exists for the broader Expedition vulnerability chain.",
@@ -114940,7 +114940,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported via ESET's tracking of the RomCom campaign; patched by Microsoft. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-49039 (CWE-287, CVSS 8.8) + CISA KEV (added 2024-11-12) + Microsoft MSRC advisory + ESET RomCom research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild as a zero-day by the Russia-aligned RomCom threat actor, chained with a Mozilla Firefox zero-day (CVE-2024-9680) to escape the browser sandbox and escalate to Medium integrity with no user interaction, in campaigns against European and North American targets between October and November 2024.",
@@ -115034,7 +115034,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported via CERT-UA and ClearSky Cyber Security tracking of the UAC-0194 campaign. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43451 (CWE-73, CVSS 6.5) + CISA KEV (added 2024-11-12) + Microsoft MSRC advisory + CERT-UA/ClearSky reporting.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day by the Russia-aligned threat actor UAC-0194 (tracked by CERT-UA and ClearSky) in phishing campaigns against Ukrainian government entities beginning mid-2024, using malicious .url files that trigger an NTLMv2 hash leak via SMB on minimal user interaction to deploy SparkRAT.",
@@ -115129,7 +115129,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Metabase via coordinated disclosure and fixed by the Metabase development team. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-41277 (CWE-22/CWE-200, CVSS 10.0) + CISA KEV (added 2024-11-12) + Metabase security advisory GHSA-w73v-6p7p-fpfr.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild; added to CISA KEV on 2024-11-12, roughly three years after disclosure, reflecting sustained real-world targeting of internet-exposed Metabase instances to harvest cloud credentials from environment variables.",
@@ -115224,7 +115224,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to Atlassian through their standard vulnerability disclosure process and fixed in Jira Server/DC 8.5.14/8.13.6/8.16.1. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2021-26086 (CWE-22, CVSS 5.3) + CISA KEV (added 2024-11-12) + Atlassian JRASERVER-72695.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV in November 2024 citing active exploitation of unauthenticated file-read against internet-facing Jira Server/Data Center instances, used to harvest servlet-mapping and configuration detail from web.xml ahead of follow-on attacks. Not flagged as ransomware-associated.",
@@ -115313,7 +115313,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Originally reported to Cisco PSIRT in 2014 (Bug ID CSCun19025); renewed 2024 exploitation surfaced through Cisco PSIRT's own monitoring and third-party reporting (CloudSEK), not AI-attributed.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2014-2120 (CWE-79, CVSS 6.1) + CISA KEV (added 2024-11-12) + Cisco Security Advisory cisco-sa-CVE-2014-2120.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV in November 2024 after Cisco PSIRT revised its decade-old advisory (originally published 2024-03-18) to note renewed exploitation attempts, with a further bulletin revision on 2024-12-02 confirming additional attempted exploitation. CloudSEK reports the AndroxGh0st botnet operators chaining this WebVPN login-page XSS with other Cisco ASA/IOS flaws in attempts to upload and backdoor PHP files for persistence. Not flagged as ransomware.",
@@ -115497,7 +115497,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Vulnerability documented by independent researcher analysis (dreyand.rs write-up) and patched by the CyberPanel maintainer (commit 5b08cd6); PSAUX ransomware operators separately discovered and mass-weaponized it. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-51567 (CWE-306, CVSS 10.0) + CISA KEV (added 2024-11-07, ransomware: Known) + CyberPanel fix commit 5b08cd6.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in the wild since October 2024 by the PSAUX ransomware operation, which used an automated script (ak47.py) to compromise over 22,000 internet-facing CyberPanel instances, deploy a custom encryptor (actually.sh), and drop ransom notes system-wide. CISA flags this KEV entry as ransomware-associated (ransomware: Known).",
@@ -115586,7 +115586,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed through Google/AOSP's internal security review process (Android Security Bulletin); in-the-wild use was surfaced by mobile-security researchers tracking targeted spyware campaigns, not AI tooling.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43093 (CWE-176, CVSS 7.3) + CISA KEV (added 2024-11-07) + Android Security Bulletin 2025-03-01.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited in targeted mobile spyware / cyber-espionage campaigns against activists, journalists, and dissidents; researchers have also linked exploitation attempts to the TOXIC PANDA Android banking-trojan operation. CISA added it to KEV in November 2024; not flagged as ransomware.",
@@ -115681,7 +115681,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by independent security researchers in 2019 with coordinated PacketStorm/Exploit-DB write-ups; developer Marcus Glocker confirmed a fix. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2019-16278 (CWE-22, CVSS 9.8) + CISA KEV (added 2024-11-07) + Nostromo changelog (nazgul.ch/dev/nostromo_cl.txt).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA added this to KEV in November 2024 citing ongoing internet-wide scanning and exploitation of exposed Nostromo nhttpd servers for remote code execution; the flaw has historically been weaponized in Linux/IoT botnet scanning campaigns since 2019. Not flagged as ransomware.",
@@ -115877,7 +115877,7 @@
     },
     "ai_discovered": true,
     "ai_discovery_notes": "GreyNoise's proprietary internal LLM tool 'Sift' flagged anomalous honeypot traffic that didn't match known signatures; GreyNoise Labs researchers investigated the flagged traffic and identified CVE-2024-8956 (paired with the related CVE-2024-8957). Confirmed via GreyNoise's own announcement and independent press coverage (SecurityWeek, BleepingComputer).",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "discovery_attribution_note": "Curated from NVD CVE-2024-8956 (CWE-306/CWE-287, CVSS 9.1) + CISA KEV (added 2024-11-04) + GreyNoise Labs advisory. AI-assisted discovery: GreyNoise Labs surfaced the flaw with its internal Sift LLM anomaly-detection tool from honeypot telemetry.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "GreyNoise observed active scanning and exploitation attempts against the vulnerable /cgi-bin/param.cgi endpoint on live-streaming PTZ cameras shortly after disclosure; not flagged as ransomware-associated by CISA.",
@@ -115968,7 +115968,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to the Roundcube project via responsible disclosure and fixed in 1.5.7/1.6.7. No AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-37383 (CWE-79, CVSS 6.1) + CISA KEV (added 2024-10-24) + Roundcube GitHub security patch/release notes.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in June 2024 phishing campaigns (reported by Positive Technologies) targeting government organizations in the CIS region, using SVG-embedded payloads in email attachments to inject fake login forms and steal credentials.",
@@ -116253,7 +116253,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Fixed by Microsoft in the July 2024 Patch Tuesday release; no AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-38094 (CWE-502, CVSS 7.2) + CISA KEV (added 2024-10-22, ransomware=Known) + Microsoft MSRC advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild using a publicly disclosed proof-of-concept to plant a webshell on a compromised SharePoint server; CISA KEV flags this entry as ransomware-associated (Known).",
@@ -116342,7 +116342,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Identified jointly by Rackspace and ScienceLogic while investigating a customer-reported monitoring-portal disruption. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9537 (CWE unassigned, CVSS 9.8) + CISA KEV (added 2024-10-21) + ScienceLogic community advisory + Rackspace incident disclosure. CWE assigned editorially: NVD published no CWE for this entry.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as a zero-day against Rackspace's MyRack monitoring portal (a hosted ScienceLogic SL1 deployment), disrupting monitoring-graph availability and exposing customer account names, usernames, device details, and encrypted internal credentials. Not flagged as ransomware-associated by CISA.",
@@ -116443,7 +116443,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and responsibly disclosed to Veeam by watchTowr Labs researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-40711 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-10-17, ransomware=Known) + Veeam KB4649 + watchTowr Labs advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited at scale by Akira and Fog ransomware affiliates within days of watchTowr Labs' public technical write-up, typically chained with compromised VPN credentials to gain initial network access before exploiting the Veeam RCE for domain/backup-infrastructure compromise.",
@@ -116546,7 +116546,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by ESET researchers (as part of RomCom campaign tracking) to Mozilla on 2024-10-08. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-9680 (CWE-416, CVSS 9.8) + CISA KEV (added 2024-10-15) + Mozilla Security Advisory MFSA2024-51.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Discovered in the wild by ESET on 2024-10-08 as the trigger for a RomCom (Storm-0978/Tropical Scorpius/UNC2596) zero-click drive-by campaign that chained this Firefox content-process UAF with Windows privilege-escalation flaw CVE-2024-49039 to escape the sandbox and drop the RomCom backdoor with no user interaction. CISA KEV flags this entry as tied to known ransomware-affiliated activity.",
@@ -116646,7 +116646,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported through Microsoft's standard vulnerability-disclosure process; observed exploitation attributed to APT34 (OilRig). No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-30088 (CWE-367, CVSS 7.0) + CISA KEV (added 2024-10-15) + Microsoft MSRC vulnerability guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Patched by Microsoft in June 2024; CISA added it to KEV on 2024-10-15 after confirming active exploitation, later attributed to the Iranian-aligned APT34 (OilRig) for post-compromise privilege escalation. KEV also flags this entry as tied to known ransomware-affiliated activity.",
@@ -116737,7 +116737,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Horizon3.ai researchers during unrelated research into the CVE-2024-28986 WHD deserialization RCE. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-28987 (CWE-798, CVSS 9.1) + CISA KEV (added 2024-10-15) + SolarWinds Trust Center advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA confirmed active exploitation and added this to KEV on 2024-10-15, roughly a month after Horizon3.ai published a working PoC; approximately 827 internet-exposed WHD instances were identified as reachable at disclosure time.",
@@ -117113,7 +117113,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed through Microsoft's standard security-update process for October 2024 Patch Tuesday, consistent with the MSHTML-spoofing technique family tracked in Void Banshee campaigns. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43573 (CWE-79, CVSS 6.5) + CISA KEV (added 2024-10-08) + Microsoft MSRC vulnerability guide.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Patched and flagged as actively exploited in Microsoft's October 2024 Patch Tuesday, added to CISA KEV on 2024-10-08. This flaw follows the same MSHTML-spoofing pattern as CVE-2024-38112 and CVE-2024-43461, which the Void Banshee APT abused to trick victims into rendering malicious content via the deprecated MSHTML/Internet Explorer engine to deliver the Atlantida infostealer.",
@@ -117206,7 +117206,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and disclosed by Elastic Security Labs threat researchers; no AI tooling credited for discovery.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43572 (CWE-707, CVSS 7.8) + CISA KEV (added 2024-10-08) + Microsoft MSRC advisory + Elastic Security Labs 'GrimResource' research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild since at least June 2024 as the 'GrimResource' technique (Elastic Security Labs), used for initial access via malicious .msc files that gain full code execution in mmc.exe; observed delivering commodity stealer payloads (e.g. PureLogs Stealer). Not flagged as ransomware-linked by CISA.",
@@ -117296,7 +117296,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported by Seth Jenkins (Google Project Zero) and Conghui Wang (Amnesty International Security Lab), in coordination with Google Threat Analysis Group; no AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-43047 (CWE-416, CVSS 7.8) + CISA KEV (added 2024-10-08) + Qualcomm October 2024 security bulletin + Google Project Zero / Amnesty International Security Lab reporting.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited as part of a targeted spyware chain: Serbian authorities used Cellebrite forensic-extraction tooling to unlock seized Android devices, then chained this Qualcomm DSP use-after-free for privilege escalation to install the 'NoviSpy' spyware against journalists and activists (Amnesty International Security Lab, Dec 2024). Not flagged as ransomware.",
@@ -117388,7 +117388,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Vulnerability researched and technical PoC published by the ProjectDiscovery research team; mass-exploitation tracked by Proofpoint. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2024-45519 (CWE-78, CVSS 10.0) + CISA KEV (added 2024-10-03) + Zimbra release notes (8.8.15p46 / 9.0.0p41 / 10.0.9 / 10.1.1) + ProjectDiscovery research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Mass-exploited beginning 2024-09-28, days after ProjectDiscovery published technical details and PoC code; attackers sent spoofed emails with base64-encoded shell commands in the CC field to drop webshells on internet-facing Zimbra servers. Not flagged as ransomware by CISA, but used for broad opportunistic RCE.",
@@ -117485,7 +117485,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Originally reported to Ivanti by an anonymous researcher via Trend Micro's Zero Day Initiative; public technical analysis and PoC by Horizon3.ai. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-29824 (CWE-89, CVSS 8.8) + CISA KEV (added 2024-10-02) + Ivanti May 2024 security advisory + Horizon3.ai research.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Exploited in the wild shortly after Horizon3.ai published a deep-dive analysis and working PoC in June 2024; CISA added it to KEV in October 2024 confirming observed exploitation against network-reachable Ivanti EPM Core servers. Not flagged as ransomware by CISA, though EPM compromise is a common precursor to broader intrusions.",
@@ -117575,7 +117575,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by an independent researcher via a GitHub proof-of-concept; no vendor advisory was issued because the product is end-of-life. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2023-25280 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-09-30, EoL/EoS product) + public GitHub PoC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against end-of-life D-Link DIR-820 routers; CISA added it to KEV noting the product is EoL/EoS with no vendor patch forthcoming, and the required action is to discontinue use rather than remediate. Not flagged as ransomware.",
@@ -117667,7 +117667,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Publicly disclosed by the CLP-team researcher group with a GitHub PoC; DrayTek issued a fix in firmware 1.5.1. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2020-15415 (CWE-78, CVSS 9.8) + CISA KEV (added 2024-09-30) + DrayTek security advisory + public GitHub PoC.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Actively exploited against internet-facing DrayTek Vigor3900/2960/300B management interfaces; added to CISA KEV in September 2024 despite the flaw and vendor fix dating to 2020, indicating a long tail of unpatched exposed devices continuing to be targeted (DrayTek routers have separately been implicated in botnet and state-linked campaigns). Not flagged as ransomware.",
@@ -117762,7 +117762,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Disclosed and patched by SAP's Product Security Response Team in 2019; public exploitation technique documented by independent Java-deserialization researchers. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2019-0344 (CWE-502, CVSS 9.8) + CISA KEV (added 2024-09-30) + SAP Security Note 2786035 + GitHub Advisory GHSA-75jg-chc9-wv8p.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "An aged (2019) flaw added to CISA KEV in September 2024, indicating renewed/ongoing active exploitation against internet-facing SAP Commerce Cloud (Hybris) instances that were never patched — likely opportunistic scanning against long-lived unpatched deployments rather than a fresh campaign. Not flagged as ransomware.",
@@ -117862,7 +117862,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported and fixed through Ivanti's own PSIRT/security-disclosure process. No AI tooling credited in the advisory or subsequent research write-ups.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2024-7593 (CWE-287/CWE-303, CVSS 9.8) + CISA KEV (added 2024-09-24) + Ivanti Security Advisory (forums.ivanti.com).",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA KEV added 2024-09-24 (due 2024-10-15) after mass scanning and exploitation of internet-exposed vTM admin panels to plant rogue administrator accounts within days of public disclosure. Ransomware use is unknown/unconfirmed.",
@@ -118118,7 +118118,7 @@
     "poc_available": false,
     "poc_description": "Horizon3.ai published a technical root-cause writeup and added a NodeZero detection test, but released no public standalone PoC/exploit. Exploitation observed is in-the-wild only; no Metasploit/ExploitDB/GitHub weaponized reproducer confirmed.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and responsibly disclosed by Horizon3.ai (researcher Zach Hanley); found 2026-05-21, reported 2026-05-22, published 2026-06-12. Some secondary press stated the finding was aided by generative AI, but the primary Horizon3 advisory names no specific AI system.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118225,7 +118225,7 @@
     "poc_available": true,
     "poc_description": "Multiple public GitHub PoCs exist, e.g. github.com/sandsoncosta/CVE-2025-26633 (arbitrary command execution via a malicious .msc/MMC snap-in) and github.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation (creates a local admin via a crafted MSC file on unpatched Windows). Both marked authorized-testing-only.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Detected in-the-wild and reported through Trend Micro / Trend Zero Day Initiative (ZDI) in cooperation with Microsoft; patched on the March 11, 2025 Patch Tuesday. No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118340,7 +118340,7 @@
     "poc_available": true,
     "poc_description": "Horizon3.ai published full technical details plus a working proof-of-concept exploit on 2025-02-19 covering all four EPM CVEs, demonstrating the crafted-UNC-path credential coercion.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118454,7 +118454,7 @@
     "poc_available": true,
     "poc_description": "Covered by the same Horizon3.ai research and proof-of-concept exploit published 2025-02-19 for the four Ivanti EPM CVEs.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118568,7 +118568,7 @@
     "poc_available": true,
     "poc_description": "Included in Horizon3.ai's 2025-02-19 technical writeup and public proof-of-concept exploit spanning all four EPM CVEs.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and reported to Ivanti by Horizon3.ai (researcher Zach Hanley). No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118682,7 +118682,7 @@
     "poc_available": false,
     "poc_description": "No public standalone weaponized PoC/Metasploit/ExploitDB module identified; the flaw is trivially reproducible (authenticated file upload) and was documented via in-the-wild webshell activity by Intezer/Solis, which are incident writeups rather than a published exploit.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Detected in-the-wild and reported by Intezer researchers (Nicole Fishbein, Joakim Kennedy, Justin Lentz) with Solis Security. No AI system credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118787,7 +118787,7 @@
     "poc_available": true,
     "poc_description": "The exact injectable endpoint and parameter (GET timeoutWarning.asp, PmSess1) are published in the Intezer and Solis Security writeups, making it directly sqlmap-exploitable; CVE aggregators list 2-3 public GitHub PoCs and a Tenable WAS detection plugin (114935) exists. Treat as publicly reproducible.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered in-the-wild by Intezer and Solis Security researchers while investigating XE Group intrusions; reported early Feb 2025. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -118899,7 +118899,7 @@
     "poc_available": false,
     "poc_description": "In-the-wild exploitation was via Cellebrite's proprietary, non-public forensic chain. No public standalone weaponized PoC has been released; the kernel fix commit and Amnesty research brief describe the flaw and chain but provide no working reproducer.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "In-the-wild use discovered and attributed by Amnesty International Security Lab (with Google's Threat Analysis Group). The kernel fix landed Nov 2024 and the CVE was announced by Greg Kroah-Hartman (2024-11-19). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119004,7 +119004,7 @@
     "poc_available": true,
     "poc_description": "Full working exploit published on GitHub by Sina Kheirkhah (@SinSinology, Summoning Team) at github.com/sinsinology/CVE-2024-4885 on Aug 30, 2024, with a technical writeup at summoning.team. Also mirrored on Sploitus.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by Sina Kheirkhah of Summoning Team with Trend Micro Zero Day Initiative (ZDI); reported to Progress Apr 24, 2024. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119113,7 +119113,7 @@
     "poc_available": true,
     "poc_description": "Public PoC/exploit code is available on GitHub, catalogued in the SecWiki/windows-kernel-exploits collection and other kernel-exploit aggregators. A compiled local-privilege-escalation exploit binary circulates for this CVE.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Not clearly credited in retrieved primary sources; the MSRC advisory does not publicly name a finder. Unconfirmed. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119223,7 +119223,7 @@
     "poc_available": true,
     "poc_description": "Weaponized Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti (Rapid7, May 2023) chains both CVEs to a shell; standalone exploit also on Packet Storm (172296).",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119335,7 +119335,7 @@
     "poc_available": true,
     "poc_description": "Covered by the same weaponized Metasploit module exploit/multi/http/pentaho_business_server_authbypass_and_ssti (Rapid7) and the Packet Storm exploit (172296), which use this bug to bypass auth before triggering the injection.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered and disclosed by Harry Withington of Aon's Cyber Solutions ('Pentah0wnage'); Metasploit module by jheysel-r7 (Rapid7). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119443,7 +119443,7 @@
     "poc_available": true,
     "poc_description": "CVE aggregators list ~3 public GitHub PoCs for the command-injection primitive; the flaw requires valid administrative credentials (PR:H) but the injection technique is public. No single vendor/Metasploit module confirmed.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported to Cisco by Wang Jincheng of the X1cT34m Laboratory, Nanjing University of Posts and Telecommunications. In-the-wild exploitation attributed to PolarEdge botnet operators (Sekoia). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119555,7 +119555,7 @@
     "poc_available": false,
     "poc_description": "No public standalone weaponized PoC located. Exploitation was in-the-wild-only (Google TAG); no ExploitDB/Metasploit/GitHub reproducer specific to CVE-2023-34192 was found.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Clement Lecigne, Google Threat Analysis Group (reported to Zimbra as an actively-exploited zero-day). No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119659,7 +119659,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC. It is a cloud/SaaS service flaw fixed server-side by Microsoft; exploitation details are private and no ExploitDB/Metasploit/GitHub reproducer exists.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Exploitation detected by Microsoft; the specific reporting researcher is not named in publicly accessible sources. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119763,7 +119763,7 @@
     "poc_available": false,
     "poc_description": "No public weaponized PoC found. ZDI-24-096 documents the ExportServlet deserialization root cause but ships no exploit; no ExploitDB/Metasploit/GitHub reproducer specific to CVE-2024-20953 was located.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Trend Micro Zero Day Initiative (ZDI-24-096); ZDI credits the researcher alias 'nexteam'. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -119867,7 +119867,7 @@
     "poc_available": true,
     "poc_description": "Multiple public weaponized PoCs: ExploitDB #43993 (BlazeDS Java Object Deserialization RCE), the depthsecurity/coldfusion_blazeds_des GitHub exploit, the 'ColdFusionPwn' AMF payload generator (ysoserial-based), and a vulhub reproducible lab.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported to Adobe by Markus Wulftange of Code White GmbH. No AI tool credited.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
@@ -120333,8 +120333,8 @@
     "poc_available": true,
     "poc_description": "Live payload. trap-core.js (48,485 bytes / 1,149 lines) shipped across the campaign (19 npm packages per The Hacker News; the GHSA-7r6r-hqg7-f6mq anchor cluster covers 10 npm packages by maintainer ddjidd5640, published 2026-05-19..21); PyPI variants auto-execute on import via `node -e` pulling JS from ddjidd564.github.io; crates.io variants run via build.rs at compile time, XOR-encrypting keystores with hardcoded key 'cargo-build-helper-2026' and exfiltrating to GitHub Gists. The malicious build IS the PoC. [Socket, 2026-05; OSV MAL-2026-4207, 2026-05-26]",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "Discovered by Socket behavioral/cross-registry detection (median 5m27s, fastest 58s after publication). No AI tool credited for discovery. ai_discovery_source=vendor_research (enum lacks 'ecosystem_detection'). [Socket, 2026-05]",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovered by Socket behavioral/cross-registry detection (median 5m27s, fastest 58s after publication). No AI tool credited for discovery. [Socket, 2026-05]",
     "ai_assisted_weaponization": true,
     "ai_assisted_notes": "Novel AI-attack vector: the payload plants .cursorrules and CLAUDE.md files containing instructions hidden with zero-width Unicode characters, designed to trick AI coding assistants (Cursor, Claude Code) into running a fake 'security scan' that discovers and exfiltrates local secrets. This is AI-assistant prompt-injection as a weaponization channel, distinct from AI-generated payload code. [Socket, 2026-05; The Hacker News, 2026-05] — maps ATLAS AML.T0051 (LLM prompt injection).",
     "active_exploitation": "confirmed",
@@ -120501,8 +120501,8 @@
     "poc_available": true,
     "poc_description": "Live payload — ~164 (escalated to ~179) malicious scoped packages were published to the public npm registry across two waves (2026-05-27 21:15–21:37 UTC; 2026-05-29 09:01–09:02 UTC) by attacker-controlled accounts mr.4nd3r50n / pik-libs / t-in-one (ce-rwb in the Microsoft cluster). The installable malicious build + obfuscated scripts/postinstall.js stager IS the PoC. Source: OSV MAL-2026-4978; SafeDep 2026-05-29; Microsoft Security 2026-05-29.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem detection by SafeDep (campaign analysis OSV cites) and Microsoft Security; OSV/GitHub Advisory Database assigned MAL-*/GHSA ids. ai_discovery_source set to `vendor_research` because the enum lacks an `ecosystem_detection` value; this note records the actual provenance.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem detection by SafeDep (campaign analysis OSV cites) and Microsoft Security; OSV/GitHub Advisory Database assigned MAL-*/GHSA ids.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-tooling credit on the payload-development side. The 7–13 KB obfuscated postinstall stager follows a conventional string-encoding/minifier pattern; no AI-generated-code fingerprint reported by the responding firms. UNVERIFIED whether any tooling was AI-assisted — no source asserts either way.",
     "active_exploitation": "confirmed",
@@ -120689,7 +120689,7 @@
     "poc_available": true,
     "poc_description": "Stack-based buffer overflow in the Ivanti Connect Secure web/IF-T component reachable by an unauthenticated remote attacker. Mandiant and Ivanti disclosed active zero-day exploitation on 2025-01-08; public technical write-ups and detection content (watchTowr, Rapid7, Mandiant) followed within days. Exploitation deploys the SPAWN malware ecosystem (SPAWNANT installer, SPAWNMOLE tunneler, SPAWNSNAIL SSH backdoor), the PHASEJAM dropper, and the DRYHOOK credential stealer.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by Ivanti/Mandiant during active-incident investigation; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Zero-day exploited from at least mid-December 2024 by the suspected China-nexus cluster UNC5337 (assessed within UNC5221) before the 2025-01-08 advisory. CISA KEV-listed same day; later flagged for known ransomware-campaign use. Ivanti's Integrity Checker Tool (ICT) is the primary on-box detection. CISA directed agencies to apply the patch and, where compromise indicators are present, factory-reset and rebuild rather than patch-in-place.",
@@ -120800,7 +120800,7 @@
     "poc_available": true,
     "poc_description": "Stack-based buffer overflow in Connect Secure reachable unauthenticated. Mandiant/Ivanti reported active exploitation beginning mid-March 2025 by UNC5221, using the TRAILBLAZE in-memory dropper and the BRUSHFIRE passive backdoor alongside the SPAWN ecosystem. The bug was patched in 22.7R2.6 before it was understood to be RCE-capable, so unpatched fleets were exploited after the fix shipped.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Vendor/Mandiant incident-driven; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Confirmed in-the-wild RCE exploitation from mid-March 2025 by UNC5221; CISA KEV-listed 2025-04-04, later ransomware-flagged. Demonstrates the 'mis-triaged severity' failure mode — a flaw patched as low-risk DoS was weaponized to RCE, so SLA prioritization keyed on the initial CVSS under-protected fleets.",
@@ -120910,7 +120910,7 @@
     "poc_available": true,
     "poc_description": "The Visual Composer Metadata Uploader endpoint (/developmentserver/metadatauploader) lacks an authorization check, letting an unauthenticated attacker upload an executable (JSP webshell) that runs with SAP service privileges. Mass exploitation observed from April 2025; ReliaQuest first reported in-wild use, with JSP webshells (helper.jsp, cache.jsp, randomly-named) dropped under the servlet path and later follow-on by ransomware affiliates.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Identified during active-incident investigation (ReliaQuest) and confirmed by SAP; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Confirmed mass in-the-wild exploitation from April 2025; CISA KEV-listed 2025-04-29 and ransomware-flagged. Frequently chained with the SAP NetWeaver deserialization flaw CVE-2025-42999. Webshell access enabled hands-on-keyboard follow-on including ransomware staging.",
@@ -121019,7 +121019,7 @@
     "poc_available": true,
     "poc_description": "An authentication-bypass in the HTTP authorization-header handling lets an unauthenticated attacker authenticate as any known/guessable account, including crushadmin, taking over the instance (unless a DMZ proxy instance fronts it). Exploited in the wild in March-April 2025; technical details and detection content published by Outpost24, VulnCheck, and Rapid7.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported to CrushFTP by Outpost24; no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Confirmed in-the-wild exploitation March-April 2025; CISA KEV-listed 2025-04-07 with known ransomware-campaign use. crushadmin takeover yields full file-server control and downstream data access; observed follow-on tooling includes remote-management agents.",
@@ -121843,7 +121843,8 @@
     "last_updated": "2026-05-13",
     "discovery_attribution_note": "AI-surfaced by Theori using Xint Code AI scanner with one operator prompt against the Linux crypto/ subsystem; researcher Taeyang Lee directed the scan. Disclosed 2026-04-29. Source: Theori writeup mirrored at https://xint.io/blog/copy-fail-linux-distributions and Sysdig coverage https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds.",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": false
+    "known_ransomware_use": false,
+    "ai_discovery_source": "bug_bounty_ai_augmented"
   },
   "CVE-2026-39884": {
     "name": "Flux159 mcp-server-kubernetes Argument Injection via port_forward",
@@ -122387,8 +122388,8 @@
     "poc_available": true,
     "poc_description": "Confirmed in-the-wild — 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. The worm itself IS the PoC; payload analysis published by multiple researchers within 20 minutes.",
     "ai_discovered": false,
-    "ai_discovery_source": "threat_actor_ai_built",
-    "ai_discovery_notes": "Engineering-grade chained CI-trust-boundary attack attributed to TeamPCP. No AI-discovery component — the primitives (pull_request_target co-residency, actions/cache poisoning, /proc/<pid>/mem token-scraping) are documented human tradecraft. Tagged threat_actor_ai_built source enum to capture the AI-relevant impact-class framing without claiming AI-discovery of the underlying primitive.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Engineering-grade chained CI-trust-boundary attack attributed to TeamPCP. No AI-discovery component — the primitives (pull_request_target co-residency, actions/cache poisoning, /proc/<pid>/mem token-scraping) are documented human tradecraft.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "Attack methodology is engineering-grade — chained primitives across CI/CD, pnpm cache, and OIDC token handling. No evidence of AI-assisted exploit development; attribution: TeamPCP.",
     "active_exploitation": "confirmed",
@@ -122709,7 +122710,8 @@
       ]
     },
     "last_updated": "2026-05-13",
-    "discovery_attribution_note": "Community report into the elementary-data maintainers within four hours of the 2026-04-24 22:20 UTC push; ecosystem detection by JFrog, Snyk, Phylum follow-up. No AI-tool discovery attribution — incident was surfaced by package-registry monitoring + maintainer triage. Source: https://snyk.io/blog/malicious-release-of-elementary-data-pypi-package-steals-cloud-credentials-from-data-engineers/."
+    "discovery_attribution_note": "Community report into the elementary-data maintainers within four hours of the 2026-04-24 22:20 UTC push; ecosystem detection by JFrog, Snyk, Phylum follow-up. No AI-tool discovery attribution — incident was surfaced by package-registry monitoring + maintainer triage. Source: https://snyk.io/blog/malicious-release-of-elementary-data-pypi-package-steals-cloud-credentials-from-data-engineers/.",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2026-46300": {
     "name": "Fragnesia",
@@ -122974,7 +122976,8 @@
     "rwep_notes": "RWEP 35. poc_available +20, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
     "last_verified": "2026-08-08",
     "epss_percentile": 0.96913,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21626"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-21626",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2024-3094": {
     "ai_assisted_weaponization": false,
@@ -123075,7 +123078,8 @@
     "rwep_notes": "RWEP 45. poc_available +20, active_exploitation +10, blast_radius +30, patch_available -15. Σ factors === rwep_score.",
     "last_verified": "2026-08-08",
     "epss_percentile": 0.9971,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3094"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3094",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2024-3154": {
     "ai_assisted_weaponization": false,
@@ -123153,7 +123157,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-3154 and the cri-o GitHub security advisory cited in verification_sources."
     },
     "epss_percentile": 0.70262,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3154"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-3154",
+    "ai_discovery_source": "vendor_research"
   },
   "CVE-2023-43472": {
     "ai_assisted_weaponization": false,
@@ -123229,7 +123234,8 @@
     },
     "last_verified": "2026-08-08",
     "epss_percentile": 0.98346,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-43472"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-43472",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2020-10148": {
     "ai_assisted_weaponization": false,
@@ -123322,7 +123328,8 @@
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2020-10148",
     "cisa_kev_due_date": "2022-05-03",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": false
+    "known_ransomware_use": false,
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2023-3519": {
     "ai_assisted_weaponization": false,
@@ -123417,7 +123424,8 @@
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2023-3519",
     "cisa_kev_due_date": "2023-08-09",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": true
+    "known_ransomware_use": true,
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2024-1709": {
     "ai_assisted_weaponization": false,
@@ -123517,7 +123525,8 @@
     "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-1709",
     "cisa_kev_due_date": "2024-02-29",
     "last_verified": "2026-08-22",
-    "known_ransomware_use": true
+    "known_ransomware_use": true,
+    "ai_discovery_source": "vendor_research"
   },
   "CVE-2026-20182": {
     "ai_assisted_weaponization": false,
@@ -123529,7 +123538,7 @@
     "cisa_kev_date": "2026-05-14",
     "poc_available": false,
     "ai_discovered": false,
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-added with active-exploitation flag 2026-05-14.",
     "affected": "Cisco SD-WAN vManage and vEdge controllers across multiple software trains.",
@@ -123693,7 +123702,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2024-40635 and the containerd GitHub security advisory / Snyk Labs PoC cited in verification_sources."
     },
     "epss_percentile": 0.20357,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-40635"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2024-40635",
+    "ai_discovery_source": "human_researcher"
   },
   "MAL-2026-TANSTACK-MINI": {
     "ai_assisted_weaponization": false,
@@ -123779,7 +123789,8 @@
         "Credential-file reads (~/.npmrc, ~/.aws/credentials, GitHub token files) by a node/npm child process spawned from an @tanstack/* install."
       ],
       "_ioc_source_note": "Anchored to the TanStack security advisory 2026-05-11 and the npm advisories cited in verification_sources."
-    }
+    },
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2026-30623": {
     "ai_assisted_weaponization": false,
@@ -123793,7 +123804,7 @@
     "poc_available": true,
     "poc_description": "Public advisory documents the argv-string concatenation in MCP-client stdio transport.",
     "ai_discovered": false,
-    "ai_discovery_source": "unknown",
+    "ai_discovery_source": "human_researcher",
     "active_exploitation": "suspected",
     "affected": "Anthropic MCP SDK stdio transport versions prior to vendor security release (Apr 2026).",
     "affected_versions": [
@@ -123931,7 +123942,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-12686 and the Zero Day Initiative Pwn2Own Ireland 2025 disclosure cited in verification_sources."
     },
     "epss_percentile": 0.84882,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-12686"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-12686",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-62847": {
     "ai_assisted_weaponization": false,
@@ -124005,7 +124017,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62847 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.5349,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62847"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62847",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-62848": {
     "ai_assisted_weaponization": false,
@@ -124079,7 +124092,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62848 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.54875,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62848"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62848",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-62849": {
     "ai_assisted_weaponization": false,
@@ -124153,7 +124167,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-62849 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.58102,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62849"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-62849",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-59389": {
     "ai_assisted_weaponization": false,
@@ -124224,7 +124239,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-59389 and the QNAP / Pwn2Own Ireland 2025 advisory cited in verification_sources."
     },
     "epss_percentile": 0.45668,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-59389"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-59389",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2025-11837": {
     "ai_assisted_weaponization": false,
@@ -124297,7 +124313,8 @@
       "_ioc_source_note": "Anchored to NVD CVE-2025-11837 and the QNAP security advisory cited in verification_sources."
     },
     "epss_percentile": 0.71129,
-    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-11837"
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2025-11837",
+    "ai_discovery_source": "human_researcher"
   },
   "CVE-2026-42945": {
     "name": "NGINX Rift",
@@ -124383,7 +124400,8 @@
         "Crafted URIs designed to match unnamed-capture rewrite patterns reaching nginx instances on the affected version range."
       ],
       "_ioc_source_note": "Anchored to the F5 advisory K000150420 and the nginx.org security advisories cited in verification_sources."
-    }
+    },
+    "ai_discovery_source": "bug_bounty_ai_augmented"
   },
   "CVE-2026-0300": {
     "name": "PAN-UID — Palo Alto Networks PAN-OS User-ID Authentication Portal RCE",
@@ -124861,8 +124879,8 @@
     "poc_available": true,
     "poc_description": "APT28 (Fancy Bear) in-wild weaponization of crafted LNK files that bypass Windows' Mark-of-the-Web protection. The exploitation chain pairs CVE-2026-32202 with CVE-2026-21513 to convert a downloaded LNK file into a SmartScreen-suppressed execution path. The chain represents an incomplete-patch class — CVE-2026-21510 attempted to close the same MOTW-bypass surface but did so incompletely, enabling the CVE-2026-32202 re-exploit primitive.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "APT28 weaponization discovered by Microsoft MAPP partners + Help Net Security reporting; no AI-tool credit on the defender-side discovery. Threat-actor side (APT28) is well-known nation-state tradecraft, not AI-assisted exploit development. Classed as vendor_research per Hard Rule #1.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "APT28 weaponization discovered by Microsoft MAPP partners + Help Net Security reporting; no AI-tool credit on the defender-side discovery. Threat-actor side (APT28) is well-known nation-state tradecraft, not AI-assisted exploit development.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted exploit development reported. APT28's LNK-weaponization toolkit predates AI-assisted exploit-development tooling by years; the CVE-2026-32202 primitive is an extension of established LNK tradecraft, not an AI-discovery.",
     "active_exploitation": "confirmed",
@@ -124978,8 +124996,8 @@
     "poc_available": true,
     "poc_description": "Picus Security 'BlueHammer' / RedSun published a working PoC BEFORE Microsoft released the patch — true zero-day disclosure. The race window is in Defender's file-remediation logic: after Defender flags a malicious file, the remediation step opens the path-to-quarantine sequence non-atomically, and an attacker-controlled junction / symlink swap during the TOCTOU window redirects the remediation operation against a SYSTEM-owned file, producing an arbitrary-file-overwrite primitive that escalates to SYSTEM via standard overwrite-to-LPE techniques.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "Discovery by Picus Security research team (the BlueHammer / RedSun writeup); no AI-tool credit in their blog post. Conventional Windows-Defender internals research. Classed as vendor_research per Hard Rule #1 (Picus is a third-party security-research firm, not a model-discovery tool).",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Discovery by Picus Security research team (the BlueHammer / RedSun writeup); no AI-tool credit in their blog post. Conventional Windows-Defender internals research.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted exploit development. The race-window primitive is conventional TOCTOU race-condition exploitation; the novelty is the target (Defender's remediation pipeline) not the technique.",
     "active_exploitation": "confirmed",
@@ -125099,8 +125117,8 @@
     "poc_available": true,
     "poc_description": "Live payload — three malicious versions (node-ipc 9.1.6, 9.2.3, 12.0.1) were published to the public npm registry by attacker-controlled account `atiertant` on 2026-05-14 and remained installable for the exposure window before npm yank. The malicious build IS the PoC.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
-    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem telemetry detection by Socket, StepSecurity, Semgrep, and Datadog Security Labs within hours of publication; The Hacker News surfaced the consolidated report. ai_discovery_source set to `vendor_research` because the enum does not include an `ecosystem_detection` value; the attribution note records the actual provenance.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "No AI-tool credited for discovery. Concurrent ecosystem telemetry detection by Socket, StepSecurity, Semgrep, and Datadog Security Labs within hours of publication; The Hacker News surfaced the consolidated report.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-tooling credit on the payload-development side. The 80 KB obfuscated IIFE follows a conventional minifier-plus-string-encoding pattern; no AI-generated code fingerprint reported by the responding firms.",
     "active_exploitation": "confirmed",
@@ -125321,7 +125339,8 @@
         "Kernel/audit signatures of ptrace attach to a setuid binary immediately before its exit on an affected kernel."
       ],
       "_ioc_source_note": "Anchored to NVD CVE-2026-46333 and the public analysis cited in verification_sources."
-    }
+    },
+    "ai_discovery_source": "human_researcher"
   },
   "MAL-2026-SHAI-HULUD-OSS": {
     "name": "Shai-Hulud worm framework (TeamPCP open-source release)",
@@ -125446,7 +125465,8 @@
       "GHSA-w37p-236h-pfx3"
     ],
     "aliases_note": "CVE-2026-44484 / OSV MAL-2026-3201 / GHSA-w37p-236h-pfx3 cover the PyPI lightning (PyTorch Lightning) sub-incident of this Mini Shai-Hulud wave — distinct ids for the same campaign, tracked here rather than as a separate entry (adversarial dedup 2026-05-30 confirmed it is the PyPI side of this wave, not a distinct incident).",
-    "_editorial_note_lightning": "PyPI lightning (PyTorch Lightning) 2.6.2/2.6.3 compromise (disclosed 2026-04-30, CVE-2026-44484) folded into this entry on 2026-05-30: an adversarial dedup found it is the PyPI side of the Mini Shai-Hulud wave already scoped here (shared Bun-runtime/router_runtime.js IoCs, same campaign/timeline), not a distinct incident warranting a separate MAL-* key."
+    "_editorial_note_lightning": "PyPI lightning (PyTorch Lightning) 2.6.2/2.6.3 compromise (disclosed 2026-04-30, CVE-2026-44484) folded into this entry on 2026-05-30: an adversarial dedup found it is the PyPI side of the Mini Shai-Hulud wave already scoped here (shared Bun-runtime/router_runtime.js IoCs, same campaign/timeline), not a distinct incident warranting a separate MAL-* key.",
+    "ai_discovery_source": "unknown"
   },
   "CVE-2024-21762": {
     "ai_assisted_weaponization": false,
@@ -125668,7 +125688,7 @@
     "poc_available": false,
     "poc_description": "No public PoC; exploit observed in targeted attacks against specific individuals consistent with commercial-spyware / nation-state operator tradecraft. Apple characterized the activity as 'extremely sophisticated'.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Discovery credit not publicly disclosed by Apple at time of patch; targeted-spyware operator activity rather than AI-assisted discovery.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -125997,7 +126017,7 @@
     "poc_available": true,
     "poc_description": "Public 'Glass Cage' chain on GitHub uses CVE-2025-43300 as the initial-access primitive (TIFF SamplesPerPixel vs JPEG SOF3 metadata mismatch). Apple confirmed in-the-wild exploitation as part of an 'extremely sophisticated attack' against targeted individuals.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Apple-internal disclosure; full attribution undisclosed.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126081,7 +126101,7 @@
     "poc_available": true,
     "poc_description": "Public 'chronomaly' PoC on GitHub (farazsth98/chronomaly) targets vulnerable x86_64 Linux kernels v5.10.x. Race between handle_posix_cpu_timers() and posix_cpu_timer_del() triggered when a task exits while CPU timers are being removed; improper exit_state handling opens an LPE window. Confirmed used as a zero-day to escape Android application sandbox.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Google Android Security Bulletin September 2025 attribution; no AI-tool credit.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126320,7 +126340,7 @@
     "poc_available": true,
     "poc_description": "Public Rapid7 advisory + Metasploit module + ishwardeepp PoC on GitHub. Invalid-UTF-8 byte sequences interact with PostgreSQL string-escaping routines and psql meta-command processing to permit injection and arbitrary command execution. Exploited in BeyondTrust + US Treasury breaches.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Rapid7 disclosure during BeyondTrust incident triage; no AI-tool attribution.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126405,7 +126425,7 @@
     "poc_available": true,
     "poc_description": "Wiz Research disclosure with full technical details. 13-year-old UAF in Redis Lua interpreter; post-auth attacker sends crafted Lua script to escape sandbox and achieve native code execution. Default Redis deployments without auth enable unauthenticated exploitation.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Wiz Research disclosure (human-led); no AI-tool credit.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "suspected",
@@ -126486,7 +126506,7 @@
     "poc_available": true,
     "poc_description": "Public exploit code observed; active opportunistic scanning of internet-exposed MongoDB instances reported. Mismatched length fields in zlib-compressed wire-protocol headers cause MongoDB Server to return uninitialized heap memory to unauthenticated clients.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Bitsight + MongoDB-coordinated disclosure; no AI-tool attribution.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -126569,8 +126589,8 @@
     "poc_available": true,
     "poc_description": "Public PoC tooling (moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS). Attacker uses malformed WINDOW_UPDATE, PRIORITY, or DATA frames to trigger server-side stream resets while backend continues processing, bypassing MAX_CONCURRENT_STREAMS and exhausting resources. Disclosed 2025-08-13 by Tel Aviv University + Imperva researchers.",
     "ai_discovered": false,
-    "ai_discovery_source": "academic_ai_fuzzing",
-    "ai_discovery_notes": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. ai_discovery_source set to academic_ai_fuzzing as the closest enum match for protocol-fuzzing research, though specific AI-fuzzing tool credit was not published.",
+    "ai_discovery_source": "human_researcher",
+    "ai_discovery_notes": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. No AI-fuzzing tool is credited in the published research.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "none",
     "affected": "HTTP/2 implementations including Apache Tomcat, Netty (CVE-2025-55163), Varnish, Fastly, F5, SUSE-shipped libraries, Wind River. Estimated 2.8M+ internet-facing instances vulnerable.",
@@ -126625,7 +126645,7 @@
         "published_date": "2025-08-13"
       }
     ],
-    "discovery_attribution_note": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. ai_discovery_source set to academic_ai_fuzzing as the closest enum match for protocol-fuzzing research, though specific AI-fuzzing tool credit was not published. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-8671",
+    "discovery_attribution_note": "Tel Aviv University academic disclosure paired with Imperva production traffic analysis. No AI-fuzzing tool is credited in the published research. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-8671",
     "live_patch_tools": [],
     "cwe_refs": [
       "CWE-1395"
@@ -126651,7 +126671,7 @@
     "poc_available": false,
     "poc_description": "Pre-emptive disclosure — Google's Big Sleep AI agent identified the bug from threat-intelligence signals before any in-the-wild exploit landed. Google publicly stated this was 'the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild'.",
     "ai_discovered": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_discovery_date": "2025-07-15",
     "ai_discovery_notes": "Google DeepMind + Project Zero 'Big Sleep' AI agent. First documented AI-agent zero-day prevention. Integer overflow → array out-of-bounds read in SQLite < 3.50.2.",
     "ai_assisted_weaponization": false,
@@ -126732,7 +126752,7 @@
     "poc_available": true,
     "poc_description": "OX Security disclosure with full chain: malicious video URL submitted to vLLM API → OpenCV decodes via bundled FFmpeg 5.1.x → heap overflow in JPEG2000 decoder. Heap address leak primitive sourced from PIL error message in earlier vulnerable vLLM versions facilitates exploitation.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "OX Security human research disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "suspected",
@@ -126814,7 +126834,7 @@
     "poc_available": true,
     "poc_description": "Crafted file upload to Ollama's model-quantization API causes out-of-bounds heap read; server process memory (potentially including model weights, conversation context, API keys) leaks to unauthenticated client.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Coordinated disclosure to Ollama security team.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "none",
@@ -126894,7 +126914,7 @@
     "poc_available": true,
     "poc_description": "Cyata 'LangGrinch' writeup demonstrates end-to-end exploitation. dumps()/dumpd() do not escape free-form dictionaries containing the internal 'lc' key marker; attacker-controlled LLM response fields (additional_kwargs / response_metadata) are deserialized as legitimate LangChain objects, leaking secrets and enabling code execution paths.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Cyata research team discovery via prompt-injection attack-surface analysis.",
     "ai_assisted_weaponization": true,
     "ai_assisted_notes": "Exploitation depends on prompt-injection triggering an LLM to emit a payload-shaped response — i.e. the LLM IS the weaponization primitive.",
@@ -126981,7 +127001,7 @@
     "poc_available": true,
     "poc_description": "In-the-wild exploit observed by Microsoft Threat Intelligence prior to disclosure. Huntress reported PDB-path evidence (folder '2024_02_19') suggesting the exploit chain pre-dates disclosure by ~12 months. Used in ransomware operations per CISA February 2026 follow-up.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft Threat Intelligence Center disclosure; no AI-tool attribution.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127067,7 +127087,7 @@
     "poc_available": true,
     "poc_description": "Active exploitation by ransomware groups confirmed by CISA in February 2026 follow-up. Chained with CVE-2025-22224 (TOCTOU) and CVE-2025-22226 (memory leak) for full VM-escape → hypervisor-management access.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft Threat Intelligence Center co-disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127149,7 +127169,7 @@
     "poc_available": true,
     "poc_description": "Third-in-chain CVE in the VMSA-2025-0004 cluster; HGFS (Host Guest File System) memory leak provides the heap-address oracle used to weaponize CVE-2025-22224 + CVE-2025-22225. Active exploitation confirmed by Broadcom as 'observed in attacks'.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft Threat Intelligence Center co-disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127233,7 +127253,7 @@
     "poc_available": true,
     "poc_description": "Live malicious payload in ultralytics 8.3.41 and 8.3.42 (the first 'remediation' release inadvertently re-shipped the malicious code). XMRig cryptominer downloaded post-install via downloader code injected through a GitHub Actions script-injection in the build environment by openimbot.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "ReversingLabs + Wiz + HiddenLayer concurrent ecosystem-telemetry detection.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127319,7 +127339,7 @@
     "poc_available": true,
     "poc_description": "Live malicious packages — Ruby gems harvested env vars + SSH keys + AWS credentials + .npmrc + .netrc + GitHub CLI config + RubyGems credentials to a hidden C2 endpoint. Go modules modified GITHUB_ENV, poisoned GOPROXY, weakened checksum protections, tampered with go.sum, and planted fake `go` wrappers in workflow execution paths.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Socket.dev research disclosure; concurrent reporting by other supply-chain firms.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127408,7 +127428,7 @@
     "poc_available": true,
     "poc_description": "11 PyPI packages published by a single threat actor between 2025-05-04 and 2025-05-24, split across four payload variants targeting the Solana ecosystem (browser-stored credentials, crypto wallets, sensitive session cookies). Multiple downstream variants — coloramapkgsw, coloramapkgsdow, coloramashowtemp, coloramapkgs, readmecolorama, colorizator, coloraiz, and related — extend the colorama / colorizr typosquat pattern.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Imperva Threat Research + Checkmarx + Check Point ecosystem-telemetry detection.",
     "ai_assisted_weaponization": false,
     "active_exploitation": "confirmed",
@@ -127903,7 +127923,7 @@
     "poc_available": false,
     "poc_description": "Pre-emptive AI-agent discovery; no public PoCs at disclosure time. Bugs reported through standard upstream-vendor responsible-disclosure channels with patches landing before public PoC publication.",
     "ai_discovered": true,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "bug_bounty_ai_augmented",
     "ai_discovery_date": "2025-08-04",
     "ai_discovery_notes": "Google DeepMind + Project Zero 'Big Sleep' AI agent (Gemini-backed) reported the first 20 vulnerabilities it found, disclosed publicly by Heather Adkins on 2025-08-04. Targets included FFmpeg media library and ImageMagick editing suite — both with massive downstream redistribution surface.",
     "ai_assisted_weaponization": false,
@@ -141121,7 +141141,7 @@
     "poc_available": false,
     "poc_description": "CISA KEV-listed with Microsoft 'Exploitation Detected'. No public proof-of-concept repository verified at curation time; exploitation is confirmed regardless of public PoC status.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Microsoft's MSRC process; no AI-discovery attribution surfaced.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization reported.",
@@ -141235,7 +141255,7 @@
     "poc_available": false,
     "poc_description": "CISA KEV-listed (confirmed exploitation). No public proof-of-concept repository referenced by NVD or the Trend Micro advisory at curation time.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Trend Micro / ZDI coordinated disclosure; no AI-discovery attribution surfaced.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization reported.",
@@ -141348,7 +141368,7 @@
     "poc_available": false,
     "poc_description": "CISA KEV-listed with Microsoft 'Exploitation Detected'. No public proof-of-concept repository verified at curation time.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Reported through Microsoft's MSRC process; no AI-discovery attribution surfaced.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization reported.",
@@ -167195,7 +167215,7 @@
     "poc_available": true,
     "poc_description": "KeyTrap PoC zones and analysis published with the Feb 2024 coordinated disclosure; ISC/NLnet Labs/PowerDNS advisories document the attack and the work-bounding fixes.",
     "ai_discovered": false,
-    "ai_discovery_source": "academic_ai_fuzzing",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by the ATHENE / Goethe University Frankfurt research group (KeyTrap, disclosed Feb 2024). Academic protocol research, not AI-attributed by the disclosers; ai_discovered remains false.",
     "active_exploitation": "suspected",
     "active_exploitation_notes": "High-profile coordinated disclosure (BIND, Unbound, PowerDNS, Knot, Dnsmasq patched in lockstep Feb 2024). Single crafted DNSSEC response can stall a validating resolver for an extended period. Internet-scale concern; observed scanning but no confirmed sustained campaign — suspected.",
@@ -167278,7 +167298,7 @@
     "poc_available": true,
     "poc_description": "Published with the Feb 2024 coordinated DNSSEC disclosure; ISC/NLnet Labs/PowerDNS advisories document the NSEC3 work-bounding fix.",
     "ai_discovered": false,
-    "ai_discovery_source": "academic_ai_fuzzing",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Disclosed alongside KeyTrap by the ATHENE / Goethe University Frankfurt group (Feb 2024). Academic protocol research; ai_discovered false.",
     "active_exploitation": "suspected",
     "active_exploitation_notes": "Coordinated multi-vendor disclosure and patching (Feb 2024). Crafted NSEC3 responses force excessive hashing; internet-scale concern. Observed scanning, no confirmed sustained campaign — suspected.",
@@ -168010,7 +168030,7 @@
     "poc_available": false,
     "poc_description": "The Microsoft Security Update Guide entry documents the use-after-free and ships the fix, but no public proof-of-concept exploit is published; the in-the-wild use is consistent with a post-compromise privilege-escalation step rather than a public exploit.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed and patched by Microsoft via the Security Update Guide (https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30400) in the May 2025 Patch Tuesday cycle. The DWM Core Library is a core Windows desktop-compositor component, not an AI surface.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization; a use-after-free in the Windows DWM Core Library is abused as a local privilege-escalation primitive.",
@@ -168324,7 +168344,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept is published. Palo Alto Networks reports limited exploit attempts against unpatched, un-mitigated PAN-OS devices and marks the vendor exploit maturity ATTACKED, but neither the vendor advisory nor public research has released exploit code.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed in the Palo Alto Networks security advisory for CVE-2026-0257 (https://security.paloaltonetworks.com/CVE-2026-0257). No AI tool is credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization observed; the GlobalProtect portal/gateway authentication surface is reachable and bypassable directly over the network.",
@@ -168991,7 +169011,7 @@
     "poc_available": false,
     "poc_description": "The GitHub Security Advisory documents the mechanism - the POST /mcp-rest/test/connection and /mcp-rest/test/tools/list endpoints accept MCP server configs that spawn subprocesses - but ships no public proof-of-concept exploit.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed via the BerriAI GitHub Security Advisory (https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g). The abused surface is an LLM gateway/proxy (LiteLLM) and its Model Context Protocol (MCP) integration.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization; an authenticated MCP test endpoint on an LLM gateway accepts server configs that spawn arbitrary subprocesses on the host.",
@@ -169211,7 +169231,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept exploit. The vendor advisory documents the abused function (lsws.redisAble / cpanel_jsonapi_func=redisAble) and a log-based detection grep, but does not publish exploit code.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "vendor_research",
     "ai_discovery_notes": "Disclosed by LiteSpeed Technologies via their security update (https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/) and catalogued in NVD; CISA KEV-listed 2026-05-26. Identified through vendor incident response after in-the-wild exploitation, not AI tooling.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No evidence of AI-assisted weaponization. The flaw is improper privilege management on a control-panel plugin function reachable by any panel user.",
@@ -169322,7 +169342,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept is published. Check Point and CISA confirm in-the-wild exploitation against IKEv1-enabled gateways, but no exploit code has been released by the vendor or public research at the time of curation.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed in the Check Point security advisory sk185033 and accompanying blog post (https://support.checkpoint.com/results/sk/sk185033). No AI tool is credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No AI-assisted weaponization observed; the IKEv1 certificate-validation logic flaw is exploitable directly over the network against gateways accepting legacy Remote Access clients.",
@@ -169542,7 +169562,7 @@
     "poc_available": false,
     "poc_description": "No public proof-of-concept. This is a delivered supply-chain compromise rather than an exploit against a software flaw: the malicious code shipped inside the official installer, so the 'exploit' was the trojanized package itself reaching users via the legitimate download path.",
     "ai_discovered": false,
-    "ai_discovery_source": "human_researcher",
+    "ai_discovery_source": "vendor_research",
     "ai_discovery_notes": "Disclosed by the vendor (AVB Disc Soft) via the DAEMON Tools security-incident notice (https://blog.daemon-tools.cc/post/security-incident) and catalogued in NVD; CISA KEV-listed 2026-05-27. The compromise was identified through the vendor's incident response, not AI tooling.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No evidence of AI-assisted weaponization. The attacker compromised the vendor's build/distribution infrastructure and trojanized signed binaries; the technique is classic build-pipeline compromise.",
@@ -169653,7 +169673,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited unauthenticated deserialization RCE. Unauthenticated deserialization of crafted input executes code and plants JSP webshells on Windchill/FlexPLM.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed by PTC (advisory published 2026-06-17). No AI tool credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "In-the-wild webshell deployment; no AI-build attribution.",
@@ -169759,7 +169779,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited unauthenticated SSRF-to-root. Unauthenticated SSRF in the WebDialer HTTP handler chained to attacker-controlled file write and root escalation; public PoC available.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "Disclosed by Cisco PSIRT (advisory cisco-sa-cucm-ssrf-cXPnHcW) on 2026-06-03. No AI tool credited with discovery.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "Public PoC exploit code released by security researchers; no AI-build attribution.",
@@ -170297,7 +170317,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited missing authentication for a critical function. watchTowr Labs published a working pre-auth RCE PoC chaining the unauthenticated sidecar restore endpoint through pg_restore connection-string injection and lo_export to write/overwrite Splunk Python scripts, yielding code execution as the splunk user.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. The Splunk vendor advisory SVD-2026-0603 credits discovery to a named human researcher, \"Alex Hordijk (hordalex)\" (https://advisory.splunk.com/advisories/SVD-2026-0603). No primary source credits any named AI system with finding the flaw. watchTowr Labs (Piotr Bazydlo @chudyPB and Yordan Ganchev) published an independent technical analysis and PoC AFTER vendor disclosure — they reverse-engineered the patch, they did not discover the vulnerability (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/).",
     "ai_assisted_weaponization": true,
     "ai_assisted_notes": "watchTowr Labs states their public exploit was built with assistance from \"Project Red,\" their internal LLM-driven vulnerability reproduction harness, which was used to identify the vulnerable API endpoint and craft exploitation requests; human researchers Piotr Bazydlo and Yordan Ganchev performed the analysis and finalized the pg_dump/pg_restore chain (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/, corroborated by https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html). Caveat: this named-AI assistance applies to watchTowr's research/PoC, not to any confirmed in-the-wild attacker tooling.",
@@ -170517,7 +170537,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited symlink-following cross-account file access. Two public GitHub PoCs (e.g. fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) demonstrate planting a symlink that the root-running LiteSpeed plugin follows during certificate/usage JSON-API calls, escaping CageFS to read/write files across tenant boundaries and reach root.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. The LiteSpeed vendor advisory credits discovery/reporting to \"the team at Namecheap\" (a hosting provider), who reported it on 2026-05-31; no named AI tool/agent is credited anywhere. Source: https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ and https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html . (One third-party write-up at yazoul.net notes it was \"drafted with large-language-model assistance\" — that refers to the blog prose, not the vulnerability discovery or exploit, so it does not establish AI discovery.)",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates the exploit was AI-built. Two public PoC exploits exist (e.g. github.com/fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) but are human-authored; no AI weaponization is claimed or evidenced.",
@@ -171062,7 +171082,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited OS command injection. watchTowr Labs published a full \"SonicBoom\" write-up and exploit chain (CVE-2024-38475 admin session-token leak → CVE-2023-44221 command injection) demonstrating an unauthenticated-to-remote-shell path on SMA100 appliances; public technical PoC available.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. SonicWall's advisory SNWLID-2023-0018 and corroborating reporting credit human security researcher Wenjie Zhong (alias \"H4lo\") of DBappSecurity Co. Ltd.'s Webin lab with finding and reporting the flaw; it was disclosed in December 2023. No AI tool/agent is named in any primary source. Sources: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 ; https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public end-to-end exploit chain (codenamed \"SonicBoom\") was researched, built, and documented by human analysts at watchTowr Labs. Source: https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-cve-2024-38475/",
@@ -171170,7 +171190,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited authenticated code injection to root. No public PoC or exploit code released; KEV-confirmed in-the-wild abuse where an admin-privileged Fabric OS user supplies a crafted IP-address value to inject code and gain full root execution on Fabric OS 9.1.0 through 9.1.1d6.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "No AI involvement in discovery. The Broadcom/Brocade vendor advisory (BSA-2025-2930, doc 25602) credits no researcher, firm, or tool at all; neither The Hacker News nor CSO Online reporting names a discoverer. There is no primary source crediting any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, GTIG, etc.) with finding this. Per the conservative rule, ai_discovered=FALSE. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602 ; https://thehackernews.com/2025/04/cisa-adds-actively-exploited-broadcom.html",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No public exploit code or PoC exists, and no source indicates AI-assisted exploit development. Exploitation is KEV-confirmed in-the-wild but no weaponization tooling, exploit author, or AI-build claim has been published.",
@@ -171385,7 +171405,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited webshell creation on the web server. No public exploit code or technical PoC has been released; the vendor classes the flaw as \"unspecified,\" and it was exploited only as an in-the-wild zero-day via authenticated webshell creation/execution against the Commvault Web Server.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "ai_discovery_notes": "No AI tool is credited with discovery. The vulnerability surfaced through incident detection: Microsoft notified Commvault of anomalous activity within Commvault's Azure environment on 2025-02-20, exposing the nation-state zero-day exploitation. Both the Commvault advisory (https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html) and downstream reporting (Wiz: https://www.wiz.io/vulnerability-database/cve/cve-2025-3928) name no discoverer/AI system — it was found-in-the-wild via cloud-provider telemetry, not by Big Sleep/XBOW/ZeroPath/o-series or any named AI. Conservative determination: FALSE.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the exploit/webshell tooling to any AI system. The observed weaponization was conventional: an authenticated actor wrote and executed .aspx webshells on the Commvault Web Server, then pivoted to stored Azure/M365 application secrets. No AI-assisted exploit development is reported.",
@@ -171715,7 +171735,7 @@
     "poc_available": true,
     "poc_description": "KEV-listed, actively-exploited CoreAudio memory-corruption RCE via a crafted media file. No clean standalone weaponized PoC is publicly published for the bug itself; a Full Disclosure write-up (seclists, Jun 2025) describes the zero-click iMessage chain (CVE-2025-31200 CoreAudio RCE + CVE-2025-31201 PAC bypass), and an independent researcher reported a live crafted-media-file trigger on iOS 18.2 to Apple.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. Apple's security advisory (support.apple.com/en-us/122282) credits the fix to \"Apple\" and the discovery is jointly attributed to Apple and Google's Threat Analysis Group (TAG) — a human threat-intelligence team that tracks commercial/mercenary surveillance vendors. An independent researcher (Joseph Goydish II) is also reported to have found and disclosed a live CoreAudio media-file zero-day to Apple in Dec 2024. No primary source credits any named AI system (Big Sleep, XBOW, ZeroPath, OpenAI o-series, etc.) with discovery. Sources: https://support.apple.com/en-us/122282 ; https://www.bleepingcomputer.com/news/security/apple-fixes-two-zero-days-exploited-in-targeted-iphone-attacks/ ; https://www.wiz.io/vulnerability-database/cve/cve-2025-31200",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. The in-the-wild exploitation matches the commercial/mercenary-spyware pattern (zero-click iMessage delivery against targeted high-risk individuals, co-reported by Google TAG). No primary source attributes the exploit chain to any AI tooling.",
@@ -172267,7 +172287,7 @@
     "poc_available": true,
     "poc_description": "Public PoC/exploit available. Forge a __VIEWSTATE/ViewState payload signed with the product's hard-coded machineKey containing a .NET deserialization gadget chain and POST it to the CentreStack/Triofox portal to achieve unauthenticated RCE as the IIS portal app-pool user; Huntress developed working PoC exploits.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. Found during active in-the-wild exploitation by the Huntress SOC: on 2025-04-11 an internal Huntress 0-day detector alerted on the exploitation, and Huntress threat researchers (human team) then analyzed the root cause (hard-coded ASP.NET machineKey enabling ViewState deserialization). No named AI tool/agent is credited with discovery in any primary source. Vendor (Gladinet) advisory and NVD note exploitation in the wild since March 2025. Source: https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source credits any AI system with weaponization. The exploitation technique is the well-established public ASP.NET ViewState deserialization attack (ysoserial.net-style gadget chains) applied to a leaked/hard-coded machineKey; Huntress researchers hand-developed proof-of-concept exploits. No AI-assisted exploit development is reported.",
@@ -172596,7 +172616,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; the only known working exploit is the private ForumTroll/Memento Labs zero-day chain. Public technical write-ups (Kaspersky/Securelist, elasticninja, SecureLayer7) describe the root cause — an unvalidated sentinel handle (-2 pseudo-handle) mishandled during Mojo broker-side handle duplication — enabling the sandbox escape when paired with a renderer RCE.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by human researchers at Kaspersky's Global Research & Analysis Team (GReAT) — Boris Larin and Igor Kuznetsov — who detected the in-the-wild exploit chain during \"Operation ForumTroll\" and reported it to Google on 2025-03-20. No AI tool/agent is credited with discovery in any primary source; Kaspersky attributes detection to its own telemetry/technologies. Sources: https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ and https://www.kaspersky.com/about/press-releases/kaspersky-discovers-sophisticated-chrome-zero-day-exploit-used-in-active-attacks",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization. The exploit was attributed to the ForumTroll APT / Memento Labs (ex-Hacking Team) spyware tooling (Dante), with no mention of any named AI system in the build chain.",
@@ -173239,7 +173259,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. Unauthenticated super-admin takeover by replaying crafted CSF/Security-Fabric proxy requests over the Node.js websocket alternate channel with known upstream/downstream device serial numbers; public technical analysis exists (watchTowr, Forescout) but no full weaponized exploit script is publicly posted.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Not AI-discovered. The vendor advisory FG-IR-24-535 and reporting credit human researchers: CVE-2025-24472 was reported to Fortinet PSIRT by \"Sonny of watchTowr\" under responsible disclosure, and the in-the-wild exploitation (SuperBlack/Mora_001 campaign) was discovered by Forescout Research (Vedere Labs) human analysts. No named AI system is credited with discovery in any primary source. Sources: https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://www.quorumcyber.com/threat-intelligence/new-ransomware-operator-mora_001-exploits-fortinet-vulnerabilities-with-superblack/",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes AI tooling to exploit development or weaponization. The SuperBlack toolchain (Forescout-attributed) consists of conventional custom scripts, a LockBit 3.0-derived encryptor, and a custom wiper; no AI-assisted exploit-generation is reported.",
@@ -173349,7 +173369,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. UNC3886 in-the-wild chain (no public exploit PoC): from a root FreeBSD shell, inject base64-decoded loader.bin/pc.bin into a hung cat process via dd to /proc/pid/mem, overwrite the fclose GOT entry, then send EOF so cat runs the loader and loads payload.bin (lmpad backdoor), bypassing Veriexec.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Credited to Mandiant / Google Threat Intelligence Group (GTIG), a human threat-intel team that found UNC3886 exploiting it in the wild on Juniper routers; no named AI tool is credited with discovery. Quote: \"This specific technique is now tracked as CVE-2025-21590, as detailed in Juniper Network's security bulletin JSA93446.\" Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development. UNC3886 hand-built the process-injection chain (loader.bin/pc.bin/payload.bin, /proc/pid/mem writes, GOT overwrite of fclose) to bypass Junos Veriexec and load TINYSHELL-based PIC backdoors. No AI tooling is referenced in Mandiant's analysis. Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
@@ -173463,7 +173483,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; exploitation is by delivering a specially crafted VHD/VHDX whose malformed NTFS metadata overflows an ntfs.sys heap buffer when the victim mounts it, yielding local code execution.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "No AI tool or agent is credited. The three NTFS file-system zero-days patched together (CVE-2025-24993 RCE, CVE-2025-24991 OOB-read, CVE-2025-24984 info-disclosure) were reported anonymously to Microsoft, per The Hacker News coverage of the March 2025 Patch Tuesday (https://thehackernews.com/2025/03/urgent-microsoft-patches-57-security.html). The named-researcher discovery in the same batch (ESET's Filip Jurcacko, via the PipeMagic backdoor) applies to a SEPARATE CVE, CVE-2025-24983 (Win32k use-after-free LPE) — not to this NTFS RCE. Microsoft's advisory lists no acknowledged finder for CVE-2025-24993.",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source describes AI-assisted exploit development or weaponization for CVE-2025-24993. Public reporting describes a conventional VHD-mount trigger; no AI tooling is referenced in any exploitation account.",
@@ -173576,7 +173596,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public PoC located; exploitation requires luring a local user to mount a crafted malicious VHD/VHDX whose malformed NTFS metadata triggers an out-of-bounds heap read, leaking memory contents to the attacker.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "No named AI system is credited. Microsoft's acknowledgments list this NTFS vulnerability as reported anonymously (no individual or vendor named). Independent reporting (Krebs on Security, Zero Day Initiative, BleepingComputer) confirms the anonymous-reporter credit and links it to the same entity that reported the sibling VHD-mounting flaws. By contrast, only CVE-2025-24983 (Win32k) in this March 2025 batch carries a named human discoverer (Filip Jurcacko / ESET). No AI attribution anywhere. Sources: https://krebsonsecurity.com/2025/03/microsoft-6-zero-days-in-march-2025-patch-tuesday/ ; https://www.zerodayinitiative.com/blog/2025/3/11/the-march-2025-security-update-review",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the in-the-wild exploit code or its weaponization to any AI tool or AI-assisted workflow. Exploitation is described as crafting a malicious VHD/VHDX and socially engineering a user into mounting it; no AI-generation claim is made by Microsoft, ESET, Trend Micro, or ZDI.",
@@ -173693,7 +173713,7 @@
     "poc_available": true,
     "poc_description": "Public PoC/exploit available. Public detection/mitigation scripts and PoC material exist (vicarius.io vsociety, GitHub); exploitation triggers by inducing a victim to mount a specially crafted VHD whose malformed FAT structures overflow fastfat.sys for kernel code execution.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Microsoft's MSRC advisory credits an anonymous reporter for CVE-2025-24985 (acknowledged together with the same-month NTFS bugs CVE-2025-24984/24991/24993, all attributed to \"Anonymous\"). No named AI tool/agent is credited with discovery. Multiple independent reports (BleepingComputer, ZDI, Tenable) describe it as disclosed/reported anonymously. Sources: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985 ; https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2025-patch-tuesday-fixes-7-zero-days-57-flaws/",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source describes any AI tool or agent being used to weaponize or develop an exploit for CVE-2025-24985. Exploitation was observed in the wild as a zero-day; the delivery technique (malicious VHD mounted by a tricked local user) is conventional and pre-dates this CVE. No AI involvement reported.",
@@ -173807,7 +173827,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public weaponized PoC; exploitation requires physically mounting a crafted NTFS volume (malicious USB/VHD) so the NTFS driver logs heap memory the attacker then reads back to disclose sensitive data.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "No named AI system credited. The three March 2025 Windows NTFS vulnerabilities (CVE-2025-24984, -24991, -24993) were reported to Microsoft anonymously per Patch Tuesday coverage; the MSRC advisory and NVD list no acknowledgment. Reported anonymously to a vendor PSIRT is a human/anonymous disclosure, not AI discovery. Sources: https://www.theregister.com/2025/03/12/patch_tuesday/ , https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source attributes the discovery, PoC, or any in-the-wild exploitation tooling for CVE-2025-24984 to an AI system. KEV-confirmed exploitation carries no public actor attribution and no public weaponization narrative.",
@@ -173918,7 +173938,7 @@
     "poc_available": false,
     "poc_description": "No public standalone PoC; KEV-confirmed in-the-wild exploitation only. No public exploit code from the original disclosure; the working exploit was the in-the-wild Storm-2460/PipeMagic build that races the W32PROCESS UAF in Win32k to gain a kernel primitive and elevate a local process to SYSTEM on Windows 8.1 / Server 2012 R2 and other pre-1809 builds.",
     "ai_discovered": false,
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "ai_discovery_notes": "Discovered by ESET researcher Filip Jurcacko, who found the zero-day exploited in the wild and reported it to Microsoft. ESET Research's disclosure (infosec.exchange/@ESETresearch/114148213672762050) and BleepingComputer credit the human ESET research team; no AI tool/agent is named with discovery. Found in-the-wild, not via an automated AI discovery system. https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-windows-kernel-zero-day-exploited-since-2023/",
     "ai_assisted_weaponization": false,
     "ai_assisted_notes": "No primary source credits an AI system with weaponizing or developing the exploit. The exploit was crafted and operated by the Storm-2460 threat cluster and delivered via the PipeMagic backdoor; the only AI tie-in is thematic social-engineering (PipeMagic later masqueraded as an open-source ChatGPT desktop app), which is lure branding, not AI-assisted exploit development.",
@@ -174071,7 +174091,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to WordPress via responsible disclosure by TF1T, dtro, and haongo. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-60137 (CWE-89, CVSS 5.9 WPScan CNA) + CISA KEV (added 2026-07-21) + WordPress GHSA-fpp7-x2x2-2mjf.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-08-04). Named vendors (Rapid7, Tenable, IONIX) report in-the-wild exploitation of the wp2shell chain within days of the 2026-07-17 disclosure. Standalone, the SQLi is only reachable when a plugin/theme passes untrusted input (hence the AC:H / 5.9 CNA rating); its real-world weight is as the SQLi half of the unauthenticated RCE chain.",
@@ -174169,7 +174189,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Reported to WordPress via responsible disclosure by Adam Kues of Assetnote / Searchlight Cyber. No AI tooling credited.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-63030 (CWE-436, CVSS 9.8 WPScan CNA) + CISA KEV (added 2026-07-21) + WordPress GHSA-ff9f-jf42-662q + Rapid7 disclosure.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-21 with an accelerated 3-day due date (2026-07-24). Multiple vendors (Rapid7, Tenable, NetSPI, CyCognito) confirm in-the-wild exploitation of the wp2shell pre-auth RCE chain against default WordPress installs. This CVE is the route-confusion half that provides the validation bypass; CVE-2026-60137 provides the SQLi primitive. Temporary mitigation: block /wp-json/batch/v1 at a WAF.",
@@ -174275,7 +174295,7 @@
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and reported by human researchers at Trend Research via the Zero Day Initiative (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira). No AI tooling credited. Note: Langflow is an LLM/agent application framework, but this flaw is a conventional unauthenticated web-app RCE, not a model-level attack.",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "human_researcher",
     "discovery_attribution_note": "Curated from NVD CVE-2026-0770 (CWE-829, CVSS 9.8) + CISA KEV (added 2026-07-21) + ZDI-26-036 (ZDI-CAN-27325) + GHSA-g22f-v6f7-2hrh. Distinct from CVE-2025-3248 (a separate flaw on the same endpoint, fixed in the 1.3.x line); CVE-2026-0770 is in exec_globals handling and reaches installs up to 1.7.3.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-07-24). KEVIntel first observed in-the-wild exploitation 2026-06-27 with 220+ attempts from 64 unique IPs, deploying second-stage malware and stealing AWS credentials, environment variables, and container/cloud metadata. Exploitation is opportunistic and mass-scanned, indicating commodity weaponization. Reported to the vendor 2025-07-18; ZDI published it as a zero-day when no fix shipped by the deadline.",
@@ -174712,7 +174732,7 @@
       "reboot_required": 0
     },
     "last_verified": "2026-08-08",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated GET or POST to /api/v1/auto_login from an off-network source returning HTTP 200 with a JSON body containing access_token and refresh_token — no credential material is presented and none is checked",
@@ -176564,7 +176584,7 @@
       "reboot_required": 0
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated POST to /goanywhere/lic/accept on the GoAnywhere administrative console (default TCP 8000/8001) carrying a Base64 `bundle` parameter — the License Response Servlet deserialization sink",
@@ -177764,7 +177784,7 @@
       "reboot_required": 5
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "sslvpnd crash entries in the event log: 'Logdesc=Application crashed ... application:sslvpnd ... Signal 11 received' — the overflow's failed-attempt signature",
@@ -177971,7 +177991,7 @@
       "reboot_required": 5
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated requests that reach the SAML SP/IdP processing path on an appliance whose ns.conf contains 'add authentication samlAction' or 'add authentication samlIdPProfile'",
@@ -181024,7 +181044,7 @@
       "reboot_required": 5
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "Unauthenticated POST to /userportal/Controller with mode=451, or to /webconsole/Controller with mode=151, whose json parameter carries a _discriminator object supplying curvalue with shell metacharacters or backticks (e.g. ;`nc <host> 80`)",
@@ -181219,7 +181239,7 @@
       "reboot_required": 0
     },
     "last_verified": "2026-08-06",
-    "ai_discovery_source": "vendor_research",
+    "ai_discovery_source": "unknown",
     "iocs": {
       "behavioral": [
         "An Apex One management-console session instructing agents to perform an agent rollback to an older build outside a planned maintenance window",