@blamejs/exceptd-skills 0.21.10 → 0.21.12

package/data/cve-catalog.json

@@ -18951,7 +18951,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Not AI-discovered. The Metasploit module credits Daniel Hodson of elttam with vulnerability discovery and the original Python exploit; the published analysis is manual source review of cgiHandler in cgi.c. No AI tooling is credited on discovery or weaponisation.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Credited in the Metasploit module to Daniel Hodson (elttam) for vulnerability discovery and the Python exploit, with h00die and hdm as module authors; the technical write-up is published by elttam at https://www.elttam.com/blog/goahead/. The KEV entry lists no vendor, and the packet carries no vendor advisory reference for Embedthis. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-114 is used for cgiHandler building the forked CGI process's environment out of unfiltered HTTP request parameters, which lets an attacker set LD_PRELOAD and have the dynamic linker load a shared object of their choosing.",
+    "discovery_attribution_note": "Credited in the Metasploit module to Daniel Hodson (elttam) for vulnerability discovery and the Python exploit, with h00die and hdm as module authors; the technical write-up is published by elttam at https://www.elttam.com/blog/goahead/. The KEV entry links no vendor advisory. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-114 is used for cgiHandler building the forked CGI process's environment out of unfiltered HTTP request parameters, which lets an attacker set LD_PRELOAD and have the dynamic linker load a shared object of their choosing.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA KEV-listed on 2021-12-10 with a 2022-06-10 remediation date and the ransomware column left as Unknown, so CISA asserts confirmed exploitation but records no ransomware association. No named campaign, actor or incident appears in the sources available here — the KEV entry carries no shortDescription beyond the flaw itself and there is no vendor advisory in the reference set to attribute against. What is documented is capability and reach rather than a campaign: an ExcellentRanking Metasploit module has been public since the 2017 disclosure, and elttam's analysis counted over 735,000 hosts answering Shodan with a 'Server: GoAhead' banner, of which the vulnerable subset is those on Unix with CGI enabled and dynamically linked CGI programs. Treat exploitation as commodity and untargeted rather than attributed.",
     "attack_refs": [
@@ -51429,7 +51429,7 @@
         "Applet or JNLP fetches from hosts outside the internal application allowlist, with jar retrievals landing in the Java deployment cache",
         "A JRE lib/security/java.security whose package.access and package.definition lines do not list com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal"
       ],
-      "_ioc_source_note": "Exposure markers derive from the affected-version boundary in NVD CVE-2012-5076 (Java SE 7 Update 7 and earlier) and from the CISA KEV short description in the packet, which names com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal as the packages left unrestricted. The delivery-side behaviours match the applet delivery and the generic-Java plus native Windows/macOS/Linux targets of the Metasploit module read at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb. No exploit signature is claimed beyond what that module makes observable."
+      "_ioc_source_note": "Exposure markers derive from the affected-version boundary in NVD CVE-2012-5076 (Java SE 7 Update 7 and earlier) and from CISA's KEV short description, which names com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal as the packages left unrestricted. The delivery-side behaviors match the applet delivery and the generic-Java plus native Windows/macOS/Linux targets of the Metasploit module read at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb. No exploit signature is claimed beyond what that module makes observable."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The fix shipped in Oracle's October 2012 Critical Patch Update. Oracle's credit statement could not be retrieved - oracle.com returned HTTP 403 to every request made for this entry - so no individual finder is asserted. The Metasploit module for the flaw lists Security Explorations' SE-2012-01 report among its references alongside the Oracle CPU. Nothing in the NVD record, the KEV entry or the public exploit attributes the discovery to automated or AI-assisted analysis.",
@@ -52080,7 +52080,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Tavis Ormandy is named as the discoverer and author of the original exploit in the Metasploit module's author list and on the Exploit-DB entry, and disclosed it publicly on the Full Disclosure list in May 2013. MS13-053's acknowledgements credit reporters for seven other vulnerabilities in the bulletin and do not list one for CVE-2013-3660, which is consistent with a public disclosure rather than a coordinated report. Neither MS13-053, Exploit-DB 25912 nor the Metasploit module claims AI-assisted discovery.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2013-3660 (CWE-119, CVSS 7.8) + CISA KEV (added 2022-03-28) + Microsoft bulletin MS13-053 (KB2850851, V1.0 published 2013-07-09). Discovery and public exploit code attributed to Tavis Ormandy per Exploit-DB 25912 and the Metasploit module ppr_flatten_rec; the earlier Secunia advisory 53435 in the packet is a third-party aggregation rather than a Microsoft publication.",
+    "discovery_attribution_note": "This entry is based on NVD CVE-2013-3660 (CWE-119, CVSS 7.8), CISA KEV (added 2022-03-28), and Microsoft bulletin MS13-053 (KB2850851, V1.0 published 2013-07-09). Discovery and public exploit code are attributed to Tavis Ormandy per Exploit-DB 25912 and the Metasploit module ppr_flatten_rec; the earlier Secunia advisory 53435 is a third-party aggregation rather than a Microsoft publication.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "MS13-053 records that this vulnerability had been publicly disclosed before the bulletin, and answers the exploitation question for CVE-2013-3660 in full: 'Microsoft had not received any information to indicate that this vulnerability had been used to attack customers to achieve remote code execution when this security bulletin was originally issued. Microsoft was aware of this vulnerability being used to achieve elevation of privilege in targeted attacks. Both the remote code execution and elevation of privilege uses of this vulnerability are addressed by this update.' In-the-wild use of the escalation is therefore vendor-documented as of the bulletin's publication on 2013-07-09, and the negative Microsoft states covers remote code execution only. CISA's KEV listing of 2022-03-28, with a 2022-04-18 due date and no ransomware association recorded, is a later assertion of the same. EPSS is 0.39578 at the 98.489th percentile (2026-08-17), which is consistent with a local escalation that needs prior code execution rather than with a remotely reachable flaw.",
     "attack_refs": [
@@ -52296,7 +52296,7 @@
         "A DSL-2760U reporting firmware below 1.12 — the exposure marker, independent of any exploitation",
         "The gateway administration interface answering on a general user VLAN rather than only a management segment"
       ],
-      "_ioc_source_note": "The parameter and endpoint names are read from the NVD description of CVE-2013-5223 in the packet. The HTTP Basic authentication step, the stored-script write through todmngr.tod, and the feature-disabling behaviour used to lure an administrator back to the affected page were read from the Exploit-DB 36987 source at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/hardware/webapps/36987.pl. The firmware-version exposure marker comes from D-Link SAP10002 and the NVD CPE boundary. No exploit signature beyond what those sources show is asserted."
+      "_ioc_source_note": "The parameter and endpoint names are read from the NVD description of CVE-2013-5223. The HTTP Basic authentication step, the stored-script write through todmngr.tod, and the feature-disabling behavior used to lure an administrator back to the affected page were read from the Exploit-DB 36987 source at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/hardware/webapps/36987.pl. The firmware-version exposure marker comes from D-Link SAP10002 and the NVD CPE boundary. No exploit signature beyond what those sources show is asserted."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The original DSL-2760U disclosure went to the Full Disclosure list and Packet Storm (NVD references seclists.org/fulldisclosure/2013/Nov/76 and packetstormsecurity.com/files/123976). D-Link SAP10002's Reference section credits Liad Mizrachi for CVE-2013-5223. The later exploit code coded to this CVE is credited in its own source to Mauricio Correa of XLabs Information Security. Manual web-application testing of a router configuration UI throughout; no AI involvement claimed by any party.",
@@ -52856,7 +52856,7 @@
         "A Windows host missing update 3006226 — the exposure marker, and one that a host reboot must follow before it clears",
         "Windows XP systems in the inventory, which receive no fix for this flaw at all"
       ],
-      "_ioc_source_note": "The delivery model, the affected-file scope and the absence of any workaround are quoted from Microsoft MS14-064 at https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064. The non-browser exploitation routes are the Packet Storm entries NVD tags as Exploit references on the CVE-2014-6332 record — Avant Browser, The World Browser, HTML Compiler, Microsoft Compiled HTML Help and the Winamp Bento browser. The VBScript and array-redimension mechanism is from the NVD description in the packet and the Metasploit module metadata for exploit/windows/browser/ms14_064_ole_code_execution, which uses VBScript as its attack vector on Windows XP and PowerShell on newer systems. No specific exploit byte signature is asserted."
+      "_ioc_source_note": "The delivery model, the affected-file scope and the absence of any workaround are quoted from Microsoft MS14-064 at https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064. The non-browser exploitation routes are the Packet Storm entries NVD tags as Exploit references on the CVE-2014-6332 record: Avant Browser, The World Browser, HTML Compiler, Microsoft Compiled HTML Help and the Winamp Bento browser. The VBScript and array-redimension mechanism is from the NVD description and the Metasploit module metadata for exploit/windows/browser/ms14_064_ole_code_execution, which uses VBScript as its attack vector on Windows XP and PowerShell on newer systems. No specific exploit byte signature is asserted."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "MS14-064 records the flaw as 'privately reported' and received 'through coordinated vulnerability disclosure'. The finding is attributed to IBM X-Force: NVD references the IBM disclosure post at securityintelligence.com titled 'IBM X-Force Researcher Finds Significant Vulnerability in Microsoft Windows', and the Metasploit module's author list credits Robert Freeman alongside the exploit developers who followed. Note for the AI-attribution field specifically — X-Force is a human research organisation and nothing in these sources claims AI-assisted discovery; this was manual analysis of a long-standing OLE automation code path.",
@@ -66083,7 +66083,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Found by Jacob Baines, then at Tenable Research, while investigating a Crestron AM-100; he identified the shared AWIND codebase and enumerated the other OEM badges by hand, publishing the set as Tenable Research advisory TRA-2019-20 and later writing the Metasploit module. Manual firmware analysis of one device followed by codebase-matching across vendors — no automated or AI-assisted discovery is claimed anywhere in the disclosure.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2019-3929 (CWE-78, CWE-79, CVSS 9.8) + CISA KEV (added 2022-04-15) + Crestron security advisory 'AM-100 and AM-101 Vulnerabilities' dated 2021-07-27 and Tenable Research advisory TRA-2019-20 by Jacob Baines. The operative weakness is the CWE-78 command injection; CWE-79 in the packet reflects sibling cross-site scripting findings bundled in the same advisory.",
+    "discovery_attribution_note": "The sources are NVD CVE-2019-3929 (CWE-78, CWE-79, CVSS 9.8), CISA KEV (added 2022-04-15), the Crestron security advisory 'AM-100 and AM-101 Vulnerabilities' dated 2021-07-27 and Tenable Research advisory TRA-2019-20 by Jacob Baines. The operative weakness is the CWE-78 command injection; the CWE-79 listing reflects sibling cross-site scripting findings bundled in the same advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "The KEV listing of 2022-04-15 with a 2022-05-06 due date is CISA's evidence of in-the-wild use; no named vendor threat-intel report ties a specific actor or campaign to this CVE. What corroborates commodity exploitation is the EPSS reading of 0.98952 at the 99.926th percentile on 2026-08-16 — near the top of the entire corpus — which is what a one-request unauthenticated root RCE with a shipped nuclei template and a Metasploit module attracts. Crestron's own release notes for AM-100 1.7.1.7 / AM-101 2.8.0.27 state that the flaw exposed the filesystem and the web server certificate, and that Server.pem 'was compromised and thus required regeneration'.",
     "attack_refs": [
@@ -82138,7 +82138,7 @@
         "More than one unrar binary on a host — the distribution package plus an application-bundled copy — where only one has been updated",
         "A JSP or other web-servable file present under a mail platform's web root with a modification time matching an inbound message rather than a deployment"
       ],
-      "_ioc_source_note": "The IsRelativeSymLinkSafe / DosSlashToUnix validate-then-normalise ordering, the FSREDIR_WINSYMLINK record type, the ..\\..\\..\\tmp/shell example target, the Amavis auto-extraction path, the caveat that the web-root route fails on distributed installations, and the fixed versions 6.12 binary / 6.1.7 source were read from https://www.sonarsource.com/blog/zimbra-pre-auth-rce-via-unrar-0day/. The ~/.ssh/authorized_keys demonstration target is from the NVD description carried in the packet. Working exploit code and the archive-construction details: https://github.com/rbowes-r7/unrar-cve-2022-30333-poc and Metasploit modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb plus modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb."
+      "_ioc_source_note": "The IsRelativeSymLinkSafe / DosSlashToUnix validate-then-normalize ordering, the FSREDIR_WINSYMLINK record type, the ..\\..\\..\\tmp/shell example target, the Amavis auto-extraction path, the caveat that the web-root route fails on distributed installations, and the fixed versions 6.12 binary / 6.1.7 source were read from https://www.sonarsource.com/blog/zimbra-pre-auth-rce-via-unrar-0day/. The ~/.ssh/authorized_keys demonstration target is from the NVD description. Working exploit code and the archive-construction details are available at https://github.com/rbowes-r7/unrar-cve-2022-30333-poc and in the Metasploit modules modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb and modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by SonarSource's vulnerability research team, led by Simon Scannell, and reported to RarLab on 2022-05-04. SonarSource is an outside research team rather than the vendor's own, and its published analysis is manual source review of the validate-then-normalise ordering in UnRAR's symlink handling. No AI-assisted discovery is claimed.",
@@ -122230,7 +122230,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "CISA added this SharePoint deserialization RCE to the KEV catalog on 2026-07-01 citing confirmed active exploitation, notable because Microsoft's own advisory had rated exploitation 'Less Likely.' As of the KEV listing, public reporting states it is not yet known who is behind the activity, how the flaw is being weaponized in the wild, or the end objective; no threat actor, ransomware crew, or campaign has been publicly attributed, though CISA's record marks ransomware campaign use as Known. Exploitation requires an authenticated account with at least Site Member permissions, so observed activity likely leverages stolen/low-privilege SharePoint credentials to reach the deserialization sink. FCEB remediation was due 2026-07-04.",
-    "affected": "Microsoft SharePoint Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft SharePoint Server. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "SharePoint Server Subscription Edition",
       "SharePoint Server 2019",
@@ -122245,7 +122245,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Microsoft SharePoint Server; CISA set a 2026-07-04 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -122336,7 +122336,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "BlackPoint Cyber's Adversary Pursuit Group reported on 2026-06-29 that attackers bypassed OIDC auth on an internet-facing SimpleHelp RMM server, obtained a Technician session, and used it to push files and remotely execute malware across managed endpoints — deploying two previously undocumented samples, the TaskWeaver loader and the Djinn Stealer. This is an MSP/RMM supply-chain vector: one compromised SimpleHelp server grants downstream access to all managed systems, and the flaw defeats technician MFA because first-login self-enrollment lets the attacker register their own MFA. Horizon3 estimated ~14,000 internet-exposed SimpleHelp servers with ~7.2% using the vulnerable OIDC config. CISA KEV-listed 2026-06-29.",
-    "affected": "SimpleHelp  SimpleHelp — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "SimpleHelp. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "SimpleHelp <= 5.5.15",
       "SimpleHelp 6.0 pre-release versions",
@@ -122351,7 +122351,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed auth bypass on SimpleHelp SimpleHelp; CISA set a 2026-07-02 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -122443,7 +122443,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited as a zero-day by the suspected Russian actor Water Gamayun (aka EncryptHub / LARVA-208), documented by Trend Micro in the 'MSC EvilTwin' campaign. Delivery chains use social engineering plus provisioning packages (.ppkg), signed .msi installers, and rogue .msc console files to drop info-stealers and backdoors including SilentPrism, DarkWisp, Rhadamanthys, StealC, and custom EncryptHub PowerShell stealer variants. Targeting spanned telecom, finance, defense, and manufacturing. CISA KEV-listed 2025-03-11 with a Known ransomware association.",
-    "affected": "Microsoft Windows — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Microsoft Windows 10",
       "Windows 11",
@@ -122458,7 +122458,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed security feature bypass on Microsoft Windows; CISA set a 2025-04-01 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -122558,7 +122558,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "One of three related Ivanti EPM absolute-path-traversal/credential-coercion flaws (with CVE-2024-13160 and CVE-2024-13159) that CISA added to KEV on 2025-03-10 warning of active in-the-wild exploitation. This bug is the credential coercion in the GetHashForSingleFile method of WSVulnerabilityCore.dll. No named threat actor/ransomware group has been publicly attributed; activity is unauthenticated attackers coercing the EPM machine-account credential for NTLM relay. Federal remediation due 2025-03-31.",
-    "affected": "Ivanti Endpoint Manager (EPM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Ivanti Endpoint Manager (EPM). The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Ivanti EPM 2024 before the January 2025 Security Update",
       "Ivanti EPM 2022 before the SU6 January 2025 Security Update"
@@ -122572,7 +122572,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed credential coercion on Ivanti Endpoint Manager (EPM); CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -122672,7 +122672,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Companion Ivanti EPM absolute-path-traversal/credential-coercion flaw (the GetHashForWildcard method) grouped with CVE-2024-13161 and CVE-2024-13159; CISA KEV-listed 2025-03-10 for active in-the-wild exploitation. No specific threat actor or ransomware operator has been publicly named; exploitation is unauthenticated coercion of the EPM machine-account credential for SMB/NTLM relay. Federal remediation due 2025-03-31.",
-    "affected": "Ivanti Endpoint Manager (EPM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Ivanti Endpoint Manager (EPM). The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Ivanti EPM 2024 before the January 2025 Security Update",
       "Ivanti EPM 2022 before the SU6 January 2025 Security Update"
@@ -122686,7 +122686,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed credential coercion on Ivanti Endpoint Manager (EPM); CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -122786,7 +122786,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Third of the related Ivanti EPM absolute-path-traversal/credential-coercion flaws (the GetHashForWildcardRecursive method), listed alongside CVE-2024-13161 and CVE-2024-13160; CISA added it to KEV on 2025-03-10 citing active exploitation. As with its siblings, no named APT or ransomware group has been publicly attributed; the observed primitive is unauthenticated coercion of the EPM machine-account credential enabling NTLM relay and server takeover. Federal remediation due 2025-03-31.",
-    "affected": "Ivanti Endpoint Manager (EPM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Ivanti Endpoint Manager (EPM). The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Ivanti EPM 2024 before the January 2025 Security Update",
       "Ivanti EPM 2022 before the SU6 January 2025 Security Update"
@@ -122800,7 +122800,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed credential coercion on Ivanti Endpoint Manager (EPM); CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -122900,7 +122900,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited as a zero-day by the cybercrime crew XE Group (which pivoted from Magecart-style skimming to zero-day supply-chain intrusions), documented by Intezer and Solis Security. Attackers chained a VeraCore SQL-injection (CVE-2025-25181) to steal valid credentials, then abused this authenticated upload flaw via upload.aspx to plant ASPX webshells; targets were manufacturing and order-fulfillment firms. Intezer documented one victim compromised in 2020 with access maintained for over four years. CISA KEV-listed 2025-03-10.",
-    "affected": "Advantive VeraCore — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Advantive VeraCore. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Advantive VeraCore before 2024.4.2.1",
       "Fixed in 2024.4.2.1"
@@ -122914,7 +122914,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Advantive VeraCore; CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123005,7 +123005,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited as a zero-day by XE Group, a Vietnamese-linked cybercrime crew that pivoted from credit-card skimming to zero-day exploitation. XE Group chained this SQLi (in timeoutWarning.asp) with the file-upload flaw CVE-2024-57968 to retrieve valid credentials from the database and plant ASPX web shells for long-term persistence, in some cases maintaining access for years and targeting manufacturing/distribution supply chains. Reactivated intrusion observed Nov 5, 2024; documented jointly by Intezer and Solis Security in Feb 2025. Added to CISA KEV March 10, 2025.",
-    "affected": "Advantive VeraCore — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Advantive VeraCore. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: VeraCore through 2025.1.0",
       "Fixed: 2025.1.1.3"
@@ -123019,7 +123019,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed sql injection on Advantive VeraCore; CISA set a 2025-03-31 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123117,7 +123117,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Used in-the-wild as one link in a Cellebrite Android USB exploit chain to unlock a locked, seized device. Amnesty International Security Lab documented its use by Serbian authorities against a student activist's Samsung Galaxy A32 (seized Dec 2024); the chain enumerated emulated USB peripherals and used this bug to leak uninitialized kernel memory via crafted HID reports to defeat kernel protections. Google shipped the fix in the Android March 2025 security bulletin. Added to CISA KEV March 4, 2025.",
-    "affected": "Linux Kernel — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Linux Kernel. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: Linux kernel 3.12 up to the fix (commit 27ce405039bf)",
       "Fixed: 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, 6.12; Android March 2025 patch level"
@@ -123131,7 +123131,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed information disclosure on Linux Kernel; CISA set a 2025-03-25 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123222,7 +123222,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Actively exploited beginning Aug 30, 2024 — within hours of the public PoC release. Trend Micro's MXDR team observed attacks abusing the legitimate WhatsUp Gold process (the iisapppool\\nmconsole context) to download and stage multiple remote-management tools (Atera, Radmin) as an initial-access foothold on internet-exposed instances. Unauthenticated, so mass opportunistic scanning followed. Added to CISA KEV March 3, 2025.",
-    "affected": "Progress WhatsUp Gold — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Progress WhatsUp Gold. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: WhatsUp Gold before 2023.1.3",
       "Fixed: 2023.1.3"
@@ -123236,7 +123236,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Progress WhatsUp Gold; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123331,7 +123331,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Local kernel-mode elevation-of-privilege in win32k confirmed exploited in the wild and carried on CISA KEV with a known ransomware-campaign association. Successful exploitation yields arbitrary code execution in kernel mode (SYSTEM), the classic post-compromise step for disabling endpoint defenses, elevating payload privileges, and establishing persistence. Patched by Microsoft in the December 2018 Patch Tuesday; added to CISA KEV March 3, 2025.",
-    "affected": "Microsoft Windows — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: Windows 7, 8.1, RT 8.1, 10 (multiple builds); Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019",
       "Fixed: December 2018 security/cumulative updates"
@@ -123345,7 +123345,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed lpe on Microsoft Windows; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123441,7 +123441,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-listed (added March 3, 2025); confirmed exploited in the wild. This special-element/template injection is the code-execution half of a two-bug chain with the auth-bypass CVE-2022-43939, together yielding unauthenticated RCE as the Pentaho service user on internet-exposed BA Servers. A public Metasploit module and Packet Storm exploit (from Aon's 'Pentah0wnage' research) sharply lowered the barrier. No specific named threat actor confirmed in primary sources.",
-    "affected": "Hitachi Vantara Pentaho Business Analytics (BA) Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Hitachi Vantara Pentaho Business Analytics (BA) Server. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: Pentaho BA Server before 9.4.0.1 and 9.3.0.2, including 8.3.x",
       "Fixed: 9.4.0.1 and 9.3.0.2"
@@ -123455,7 +123455,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Hitachi Vantara Pentaho Business Analytics (BA) Server; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123553,7 +123553,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-listed (added March 3, 2025); confirmed exploited in the wild. This is the authentication-bypass half of the Pentaho chain: a non-canonical-URL authorization bypass that grants unauthenticated access to protected endpoints, then combined with the special-element injection CVE-2022-43769 for pre-auth RCE as the Pentaho service user. The public Metasploit module weaponizes both together. No specific named threat actor confirmed in primary sources.",
-    "affected": "Hitachi Vantara Pentaho Business Analytics (BA) Server — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Hitachi Vantara Pentaho Business Analytics (BA) Server. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: Pentaho BA Server before 9.4.0.1 and 9.3.0.2, including 8.3.x",
       "Fixed: 9.4.0.1 and 9.3.0.2"
@@ -123567,7 +123567,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed authorization bypass on Hitachi Vantara Pentaho Business Analytics (BA) Server; CISA set a 2025-03-24 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123661,7 +123661,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited by the PolarEdge botnet, an ORB/relay IoT botnet first detailed by Sekoia in Feb 2025. Operators use a shell script named 'q' to drop a TLS-encrypted backdoor onto end-of-life Cisco Small Business RV routers, enrolling them (alongside compromised ASUS, QNAP, and Synology devices) into a network that grew to an estimated ~25,000 devices for relaying, DDoS, and lateral movement. Because the RV series is EoL, Cisco will not patch. Added to CISA KEV March 3, 2025.",
-    "affected": "Cisco Small Business RV Series Routers — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Cisco Small Business RV Series Routers. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Affected: Cisco Small Business RV016, RV042, RV042G, RV082, RV320, RV325 routers (all firmware; end-of-life)",
       "Fixed: none — EoL, no software update will be released"
@@ -123773,7 +123773,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Discovered as an in-the-wild zero-day by Google's Threat Analysis Group during a campaign of targeted espionage against government and diplomatic Zimbra users; TAG researcher Clement Lecigne reported it after observing exploitation. The stored/reflected XSS against the /h/autoSaveDraft endpoint was used to steal email data and hijack authenticated webmail sessions. Actively exploited in July 2023 before the patch; CISA added it to KEV on 2025-02-25. Requires a victim to view attacker-planted draft content, consistent with spearphishing-style targeting.",
-    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Zimbra Collaboration Suite (ZCS) 8.8.15 up to and including Patch 40; fixed in 8.8.15 Patch 41 (no service restart required)"
     ],
@@ -123786,7 +123786,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed xss on Synacor Zimbra Collaboration Suite (ZCS); CISA set a 2025-03-18 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123877,7 +123877,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "An improper-access-control/privilege-escalation flaw in the partner.microsoft.com (Partner Center) web application, which sits on a Power Apps backend used by MSPs and enterprises to manage cloud services and customer tenants. Microsoft confirmed it detected exploitation in the wild but has not published attribution, delivery, or victim specifics. CISA added it to KEV on 2025-02-25 with a 2025-03-18 remediation deadline. Because Partner Center brokers access to downstream customer tenants, successful privilege escalation carries lateral-movement/supply-chain risk.",
-    "affected": "Microsoft Partner Center — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Partner Center. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Microsoft Partner Center (partner.microsoft.com online service) prior to the November 2024 server-side fix; remediated automatically in the cloud service"
     ],
@@ -123890,7 +123890,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed privilege escalation on Microsoft Partner Center; CISA set a 2025-03-18 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -123981,7 +123981,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "A Java deserialization RCE in the Oracle Agile PLM ExportServlet, patched in Oracle's January 2024 Critical Patch Update and reported via Trend Micro ZDI. CISA added it to KEV on 2025-02-24 (due 2025-03-17) citing confirmed in-the-wild exploitation, roughly a year after the patch. Because exploitation requires low-privileged authentication, it is most plausibly used as a post-initial-access step for code execution/takeover of the PLM host. No public threat-actor attribution has been published.",
-    "affected": "Oracle Agile Product Lifecycle Management (PLM) — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Oracle Agile Product Lifecycle Management (PLM). The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Oracle Agile PLM 9.3.6 (Export component); fixed by the January 2024 CPU"
     ],
@@ -123994,7 +123994,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Oracle Agile Product Lifecycle Management (PLM); CISA set a 2025-03-17 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -124085,7 +124085,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "An unauthenticated Java deserialization RCE in the Apache BlazeDS AMF handling used by Adobe ColdFusion, patched by Adobe in April 2017 (APSB17-14). Long a favorite of opportunistic and targeted actors against internet-exposed ColdFusion servers because it is pre-auth and has mature public tooling; CISA added it to KEV on 2025-02-24 (due 2025-03-17) reaffirming ongoing exploitation. Typically leveraged for webshell drops and server takeover of legacy ColdFusion deployments.",
-    "affected": "Adobe ColdFusion — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Adobe ColdFusion. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "ColdFusion 2016 Update 3 and earlier (fixed: Update 4)",
       "ColdFusion 11 Update 11 and earlier (fixed: Update 12)",
@@ -124100,7 +124100,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed rce on Adobe ColdFusion; CISA set a 2025-03-17 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -124195,7 +124195,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "An improper-access-control flaw in Microsoft Power Pages (low-code SaaS website platform) that let unauthenticated attackers bypass user-registration controls and gain elevated privileges to reach otherwise-restricted site data. Microsoft disclosed it on 2025-02-19 stating it had been exploited in the wild; the flaw was already mitigated service-side and affected customers were individually notified and given cleanup/review guidance. CISA added it to KEV on 2025-02-21 (due 2025-03-14). No public threat-actor attribution.",
-    "affected": "Microsoft Power Pages — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Power Pages. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "Microsoft Power Pages service prior to the February 2025 fix; mitigated in the service, affected customers notified individually"
     ],
@@ -124208,7 +124208,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed improper access control on Microsoft Power Pages; CISA set a 2025-03-14 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -124299,7 +124299,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization for this CVE.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "An authenticated arbitrary file-read on the PAN-OS management web interface (files readable by the 'nobody' user), disclosed/patched by Palo Alto on 2025-02-12 (PAN-273994). Attackers quickly chained it with the CVE-2025-0108 authentication bypass (and, on older builds, CVE-2024-9474) to read config backups, credential/hash and key material without valid credentials on exposed management interfaces; Palo Alto Unit 42/PSIRT observed the chained attacks in the wild and GreyNoise tracked 25+ malicious source IPs from ~Feb 13, 2025. Palo Alto raised the rating to high urgency after exploitation escalated. CISA added it to KEV on 2025-02-20 (due 2025-03-13).",
-    "affected": "Palo Alto Networks PAN-OS — see affected_versions and the vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Palo Alto Networks PAN-OS. The exact affected and fixed builds are in this entry's affected versions and the vendor advisory it links to.",
     "affected_versions": [
       "PAN-OS 10.1 < 10.1.14-h9",
       "PAN-OS 10.2 < 10.2.7-h24 (and later h-trains)",
@@ -124316,7 +124316,7 @@
     "live_patch_tools": [],
     "live_patch_notes": "No live-patch path for this product class; remediation is the vendor update (or, for end-of-life products, decommissioning) plus the named compensating controls until it lands.",
     "vendor_update_paths": [
-      "Apply the vendor security update per the advisory in verification_sources; follow applicable BOD 22-01 guidance for cloud services."
+      "Apply the vendor security update per the vendor advisory this entry links to; follow applicable BOD 22-01 guidance for cloud services."
     ],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "The routine 30-day flaw-remediation SLA is far longer than the in-the-wild exploitation window for this KEV-listed information disclosure on Palo Alto Networks PAN-OS; CISA set a 2025-03-13 due date, so the operationally-meaningful clock is days, not the standard patch cycle.",
@@ -129335,7 +129335,7 @@
     "ai_assisted_notes": "No AI-tooling credit on the payload-development side. The 80 KB obfuscated IIFE follows a conventional minifier-plus-string-encoding pattern; no AI-generated code fingerprint reported by the responding firms.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "The three malicious versions executed credential harvesting on every `require('node-ipc')` against installed hosts during the exposure window. Datadog Security Labs and Socket each observed real consumer-side installs of the malicious versions before yank.",
-    "affected": "node-ipc package on npm — versions 9.1.6, 9.2.3, 12.0.1 published 2026-05-14 by publisher `atiertant` (contact `a.tiertant@atlantis-software.net`). Package carries approximately 3.35M monthly downloads per npm registry telemetry; secondary reports cite 822K weekly (Socket) and 10M weekly (The Hacker News) — see source-data ambiguity note in verification_sources. Architectural impact reaches every transitive consumer that resolves any of the three malicious versions during the exposure window.",
+    "affected": "node-ipc package on npm — versions 9.1.6, 9.2.3, 12.0.1 published 2026-05-14 by publisher `atiertant` (contact `a.tiertant@atlantis-software.net`). Package carries approximately 3.35M monthly downloads per npm registry telemetry; secondary reports cite 822K weekly (Socket) and 10M weekly (The Hacker News). The sources this entry links to give these differing figures. Architectural impact reaches every transitive consumer that resolves any of the three malicious versions during the exposure window.",
     "affected_versions": [
       "node-ipc == 9.1.6 (malicious, published 2026-05-14)",
       "node-ipc == 9.2.3 (malicious, published 2026-05-14)",
@@ -132774,7 +132774,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "WebPros cPanel & WHM and WP2 (WordPress Squared) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "WebPros cPanel & WHM and WP2 (WordPress Squared). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "WebPros cPanel & WHM and WP2 (WordPress Squared) — versions per vendor advisory"
     ],
@@ -132889,7 +132889,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "ConnectWise ScreenConnect — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "ConnectWise ScreenConnect. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "ConnectWise ScreenConnect — versions per vendor advisory"
     ],
@@ -133002,7 +133002,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "D-Link DIR-823X — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "D-Link DIR-823X. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "D-Link DIR-823X — versions per vendor advisory"
     ],
@@ -133114,7 +133114,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Samsung MagicINFO 9 Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Samsung MagicINFO 9 Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Samsung MagicINFO 9 Server — versions per vendor advisory"
     ],
@@ -133227,7 +133227,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SimpleHelp  SimpleHelp — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SimpleHelp. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SimpleHelp  SimpleHelp — versions per vendor advisory"
     ],
@@ -133339,7 +133339,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SimpleHelp  SimpleHelp — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SimpleHelp. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SimpleHelp  SimpleHelp — versions per vendor advisory"
     ],
@@ -133452,7 +133452,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Catalyst SD-WAN Manger — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Catalyst SD-WAN Manger. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Catalyst SD-WAN Manger — versions per vendor advisory"
     ],
@@ -133566,7 +133566,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Catalyst SD-WAN Manager — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Catalyst SD-WAN Manager. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Catalyst SD-WAN Manager — versions per vendor advisory"
     ],
@@ -133680,7 +133680,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Kentico Kentico Xperience — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Kentico Xperience. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Kentico Kentico Xperience — versions per vendor advisory"
     ],
@@ -133793,7 +133793,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "PaperCut NG/MF — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "PaperCut NG/MF. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "PaperCut NG/MF — versions per vendor advisory"
     ],
@@ -133906,7 +133906,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor Zimbra Collaboration Suite (ZCS) — versions per vendor advisory"
     ],
@@ -134017,7 +134017,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Catalyst SD-WAN Manager — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Catalyst SD-WAN Manager. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Catalyst SD-WAN Manager — versions per vendor advisory"
     ],
@@ -134131,7 +134131,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Quest KACE Systems Management Appliance (SMA) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Quest KACE Systems Management Appliance (SMA). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Quest KACE Systems Management Appliance (SMA) — versions per vendor advisory"
     ],
@@ -134243,7 +134243,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "JetBrains TeamCity — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "JetBrains TeamCity. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "JetBrains TeamCity — versions per vendor advisory"
     ],
@@ -134357,7 +134357,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apache ActiveMQ — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apache ActiveMQ. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apache ActiveMQ — versions per vendor advisory"
     ],
@@ -134470,7 +134470,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Office — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Office. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Office — versions per vendor advisory"
     ],
@@ -134581,7 +134581,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft SharePoint Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft SharePoint Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft SharePoint Server — versions per vendor advisory"
     ],
@@ -134692,7 +134692,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Visual Basic for Applications (VBA) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Visual Basic for Applications (VBA). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Visual Basic for Applications (VBA) — versions per vendor advisory"
     ],
@@ -134803,7 +134803,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -134913,7 +134913,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Exchange Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Exchange Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Exchange Server — versions per vendor advisory"
     ],
@@ -135025,7 +135025,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -135136,7 +135136,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Adobe Acrobat — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Adobe Acrobat. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Adobe Acrobat — versions per vendor advisory"
     ],
@@ -135246,7 +135246,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet FortiClient EMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet FortiClient EMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet FortiClient EMS — versions per vendor advisory"
     ],
@@ -135357,7 +135357,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Adobe Acrobat and Reader — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Adobe Acrobat and Reader. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Adobe Acrobat and Reader — versions per vendor advisory"
     ],
@@ -135468,7 +135468,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Ivanti Endpoint Manager Mobile (EPMM) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Ivanti Endpoint Manager Mobile (EPMM). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Ivanti Endpoint Manager Mobile (EPMM) — versions per vendor advisory"
     ],
@@ -135582,7 +135582,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet FortiClient EMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet FortiClient EMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet FortiClient EMS — versions per vendor advisory"
     ],
@@ -135693,7 +135693,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TrueConf Client — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TrueConf Client. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "TrueConf Client — versions per vendor advisory"
     ],
@@ -135805,7 +135805,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Dawn — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Dawn. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Dawn — versions per vendor advisory"
     ],
@@ -135915,7 +135915,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Citrix NetScaler — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Citrix NetScaler. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Citrix NetScaler — versions per vendor advisory"
     ],
@@ -136027,7 +136027,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "F5 BIG-IP — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "F5 BIG-IP. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "F5 BIG-IP — versions per vendor advisory"
     ],
@@ -136140,7 +136140,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Aquasecurity Trivy — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Aquasecurity Trivy. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Aquasecurity Trivy — versions per vendor advisory"
     ],
@@ -145767,11 +145767,11 @@
     "_kev_short_description": "Microsoft Windows Server service contains a buffer overflow allowing unauthenticated wormable remote code execution (MS08-067).",
     "iocs": {
       "behavioral": [
-        "Microsoft Windows reachable on the network at a version below the fixed release named in the vendor advisory.",
+        "Microsoft Windows reachable on the network at a build below the fix in Microsoft security bulletin MS08-067, which the NVD record references.",
         "Unauthenticated requests to the Windows Server Service (RPC) consistent with buffer overflow.",
         "Post-exploitation indicators on the Windows Server Service (RPC) — web shells, unexpected process execution, or service crashes consistent with memory corruption — with no corresponding legitimate activity (KEV-confirmed in-the-wild exploitation)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2008-4250, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2008-4250, which references Microsoft security bulletin MS08-067, and CISA KEV (added 2026-05-20)."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -145863,11 +145863,11 @@
     "_kev_short_description": "Microsoft DirectShow QuickTime parsing memory corruption allowing remote code execution via a crafted media file.",
     "iocs": {
       "behavioral": [
-        "Microsoft Windows at a build below the fixed version named in the Microsoft advisory on an endpoint exposed to attacker-controlled documents or web content.",
+        "Microsoft Windows at a build below the fix in Microsoft security bulletin MS09-028, which the NVD record references, on an endpoint exposed to attacker-controlled documents or web content.",
         "Process crashes or memory-corruption signatures consistent with memory-corruption flaw (CWE-787) in the Windows DirectShow QuickTime parser on an affected endpoint, after the victim opens attacker-controlled content.",
         "Inbound delivery of weaponized content followed by unexpected child-process execution from the opening application (KEV-confirmed in-the-wild exploitation)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2009-1537, CISA KEV (added 2026-05-20), and the Microsoft security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2009-1537, which references Microsoft security bulletin MS09-028, and CISA KEV (added 2026-05-20)."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (client-side T1203 execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -145959,11 +145959,11 @@
     "_kev_short_description": "Adobe Acrobat and Reader heap-based buffer overflow allowing remote code execution via a crafted PDF.",
     "iocs": {
       "behavioral": [
-        "Adobe Acrobat and Reader at a build below the fixed version named in the vendor advisory on an endpoint exposed to attacker-controlled PDFs.",
+        "Adobe Acrobat and Reader at a build below the fix in Adobe security bulletin APSB09-15, which the NVD record references, on an endpoint exposed to attacker-controlled PDFs.",
         "Process crashes or memory-corruption signatures consistent with heap-based buffer overflow (CWE-122) in Adobe Acrobat and Reader on an affected endpoint.",
         "Inbound delivery of weaponized PDF documents followed by unexpected child-process execution from the Acrobat/Reader process (KEV-confirmed in-the-wild exploitation; legacy re-listing means long-tail unpatched/end-of-life estates remain exposed)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2009-3459, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2009-3459, which references Adobe security bulletin APSB09-15, and CISA KEV (added 2026-05-20)."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -146055,11 +146055,11 @@
     "_kev_short_description": "Microsoft Internet Explorer use-after-free allowing remote code execution via a crafted web page (Operation Aurora).",
     "iocs": {
       "behavioral": [
-        "Microsoft Internet Explorer at a build below the fixed version named in the vendor advisory on an endpoint exposed to attacker-controlled web content.",
+        "Microsoft Internet Explorer at a build below the fix in Microsoft security bulletin MS10-002, which the NVD record references, on an endpoint exposed to attacker-controlled web content.",
         "Process crashes or memory-corruption signatures consistent with use-after-free (CWE-416) in Internet Explorer (the 'Operation Aurora' zero-day) on an affected endpoint.",
         "Inbound delivery of weaponized web content followed by unexpected child-process execution from the Internet Explorer process (KEV-confirmed in-the-wild exploitation; legacy re-listing means long-tail unpatched/end-of-life estates remain exposed)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2010-0249, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2010-0249, which references Microsoft security bulletin MS10-002, and CISA KEV (added 2026-05-20)."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -146151,11 +146151,11 @@
     "_kev_short_description": "Microsoft Internet Explorer iepeers.dll use-after-free allowing remote code execution via a crafted web page.",
     "iocs": {
       "behavioral": [
-        "Microsoft Internet Explorer at a build below the fixed version named in the vendor advisory on an endpoint exposed to attacker-controlled web content.",
+        "Microsoft Internet Explorer at a build below the fix in Microsoft security bulletin MS10-018, which the NVD record references, on an endpoint exposed to attacker-controlled web content.",
         "Process crashes or memory-corruption signatures consistent with use-after-free (CWE-416) in the Internet Explorer iepeers component on an affected endpoint.",
         "Inbound delivery of weaponized web content followed by unexpected child-process execution from the Internet Explorer process (KEV-confirmed in-the-wild exploitation; legacy re-listing means long-tail unpatched/end-of-life estates remain exposed)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2010-0806, CISA KEV (added 2026-05-20), and the vendor security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2010-0806, which references Microsoft security bulletin MS10-018, and CISA KEV (added 2026-05-20)."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1203 client execution) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -146180,7 +146180,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Craft CMS Craft CMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Craft CMS Craft CMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Craft CMS Craft CMS — versions per vendor advisory"
     ],
@@ -146293,7 +146293,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Laravel Livewire — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Laravel Livewire. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Laravel Livewire — versions per vendor advisory"
     ],
@@ -146406,7 +146406,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -146524,7 +146524,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -146642,7 +146642,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -146757,7 +146757,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Secure Firewall Management Center (FMC) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Secure Firewall Management Center (FMC). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Secure Firewall Management Center (FMC) — versions per vendor advisory"
     ],
@@ -146869,7 +146869,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor Zimbra Collaboration Suite (ZCS) — versions per vendor advisory"
     ],
@@ -146980,7 +146980,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft SharePoint — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft SharePoint. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft SharePoint — versions per vendor advisory"
     ],
@@ -147091,7 +147091,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Wing FTP Server Wing FTP Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Wing FTP Server Wing FTP Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Wing FTP Server Wing FTP Server — versions per vendor advisory"
     ],
@@ -147203,7 +147203,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Chromium V8 — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Chromium V8. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chromium V8 — versions per vendor advisory"
     ],
@@ -147314,7 +147314,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Skia — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Skia. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Skia — versions per vendor advisory"
     ],
@@ -147425,7 +147425,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "n8n n8n — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "n8n. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "n8n n8n — versions per vendor advisory"
     ],
@@ -147537,7 +147537,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Omnissa Workspace One UEM — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Omnissa Workspace One UEM. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Omnissa Workspace One UEM — versions per vendor advisory"
     ],
@@ -147648,7 +147648,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SolarWinds Web Help Desk — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SolarWinds Web Help Desk. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SolarWinds Web Help Desk — versions per vendor advisory"
     ],
@@ -147761,7 +147761,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Ivanti  Endpoint Manager (EPM) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Ivanti Endpoint Manager (EPM). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Ivanti  Endpoint Manager (EPM) — versions per vendor advisory"
     ],
@@ -147873,7 +147873,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Hikvision Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Hikvision Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Hikvision Multiple Products — versions per vendor advisory"
     ],
@@ -147985,7 +147985,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Rockwell Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Rockwell Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Rockwell Multiple Products — versions per vendor advisory"
     ],
@@ -148098,7 +148098,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -148211,7 +148211,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -148326,7 +148326,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple iOS and iPadOS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple iOS and iPadOS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple iOS and iPadOS — versions per vendor advisory"
     ],
@@ -148438,7 +148438,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Broadcom VMware Aria Operations — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Broadcom VMware Aria Operations. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Broadcom VMware Aria Operations — versions per vendor advisory"
     ],
@@ -148551,7 +148551,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Qualcomm Multiple Chipsets — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Qualcomm Multiple Chipsets. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Qualcomm Multiple Chipsets — versions per vendor advisory"
     ],
@@ -148661,7 +148661,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco SD-WAN — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco SD-WAN. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco SD-WAN — versions per vendor advisory"
     ],
@@ -148775,7 +148775,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Catalyst SD-WAN Controller and Manager — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Catalyst SD-WAN Controller and Manager. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Catalyst SD-WAN Controller and Manager — versions per vendor advisory"
     ],
@@ -148889,7 +148889,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Soliton Systems K.K FileZen — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Soliton Systems K.K FileZen. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Soliton Systems K.K FileZen — versions per vendor advisory"
     ],
@@ -149001,7 +149001,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Roundcube Webmail — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Roundcube Webmail. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Roundcube Webmail — versions per vendor advisory"
     ],
@@ -149115,7 +149115,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Roundcube Webmail — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Roundcube Webmail. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Roundcube Webmail — versions per vendor advisory"
     ],
@@ -149228,7 +149228,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "GitLab GitLab — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "GitLab. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "GitLab GitLab — versions per vendor advisory"
     ],
@@ -149339,7 +149339,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Dell RecoverPoint for Virtual Machines (RP4VMs) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Dell RecoverPoint for Virtual Machines (RP4VMs). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Dell RecoverPoint for Virtual Machines (RP4VMs) — versions per vendor advisory"
     ],
@@ -149453,7 +149453,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor Zimbra Collaboration Suite — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor Zimbra Collaboration Suite — versions per vendor advisory"
     ],
@@ -149564,7 +149564,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TeamT5 ThreatSonar Anti-Ransomware — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TeamT5 ThreatSonar Anti-Ransomware. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "TeamT5 ThreatSonar Anti-Ransomware — versions per vendor advisory"
     ],
@@ -149677,7 +149677,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -149788,7 +149788,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Chromium — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Chromium. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chromium — versions per vendor advisory"
     ],
@@ -149898,7 +149898,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) — versions per vendor advisory"
     ],
@@ -150011,7 +150011,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -150126,7 +150126,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Configuration Manager — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Configuration Manager. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Configuration Manager — versions per vendor advisory"
     ],
@@ -150237,7 +150237,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Notepad++ Notepad++ — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Notepad++ Notepad++. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Notepad++ Notepad++ — versions per vendor advisory"
     ],
@@ -150349,7 +150349,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SolarWinds Web Help Desk — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SolarWinds Web Help Desk. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SolarWinds Web Help Desk — versions per vendor advisory"
     ],
@@ -150462,7 +150462,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -150574,7 +150574,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -150685,7 +150685,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -150797,7 +150797,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -150908,7 +150908,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -151019,7 +151019,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Office — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Office. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Office — versions per vendor advisory"
     ],
@@ -151130,7 +151130,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "React Native Community CLI — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "React Native Community CLI. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "React Native Community CLI — versions per vendor advisory"
     ],
@@ -151243,7 +151243,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SmarterTools SmarterMail — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SmarterTools SmarterMail. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SmarterTools SmarterMail — versions per vendor advisory"
     ],
@@ -151357,7 +151357,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "GitLab Community and Enterprise Editions — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "GitLab Community and Enterprise Editions. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "GitLab Community and Enterprise Editions — versions per vendor advisory"
     ],
@@ -151468,7 +151468,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Sangoma FreePBX  — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Sangoma FreePBX . The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sangoma FreePBX  — versions per vendor advisory"
     ],
@@ -151580,7 +151580,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Sangoma FreePBX — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Sangoma FreePBX. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sangoma FreePBX — versions per vendor advisory"
     ],
@@ -151692,7 +151692,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SolarWinds Web Help Desk — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SolarWinds Web Help Desk. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SolarWinds Web Help Desk — versions per vendor advisory"
     ],
@@ -151804,7 +151804,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Ivanti Endpoint Manager Mobile (EPMM) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Ivanti Endpoint Manager Mobile (EPMM). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Ivanti Endpoint Manager Mobile (EPMM) — versions per vendor advisory"
     ],
@@ -151918,7 +151918,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet Multiple Products — versions per vendor advisory"
     ],
@@ -152031,7 +152031,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Linux Kernel — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Linux Kernel. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Linux Kernel — versions per vendor advisory"
     ],
@@ -152144,7 +152144,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SmarterTools SmarterMail — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SmarterTools SmarterMail. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SmarterTools SmarterMail — versions per vendor advisory"
     ],
@@ -152258,7 +152258,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SmarterTools SmarterMail — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SmarterTools SmarterMail. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SmarterTools SmarterMail — versions per vendor advisory"
     ],
@@ -152371,7 +152371,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "GNU InetUtils — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "GNU InetUtils. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "GNU InetUtils — versions per vendor advisory"
     ],
@@ -152486,7 +152486,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Office — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Office. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Office — versions per vendor advisory"
     ],
@@ -152597,7 +152597,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Broadcom VMware vCenter Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Broadcom VMware vCenter Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Broadcom VMware vCenter Server — versions per vendor advisory"
     ],
@@ -152708,7 +152708,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor  Zimbra Collaboration Suite (ZCS) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor  Zimbra Collaboration Suite (ZCS) — versions per vendor advisory"
     ],
@@ -152820,7 +152820,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Versa Concerto — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Versa Concerto. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Versa Concerto — versions per vendor advisory"
     ],
@@ -152932,7 +152932,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Vite Vitejs — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Vite Vitejs. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Vite Vitejs — versions per vendor advisory"
     ],
@@ -153045,7 +153045,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Prettier eslint-config-prettier — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Prettier eslint-config-prettier. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Prettier eslint-config-prettier — versions per vendor advisory"
     ],
@@ -153157,7 +153157,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Unified Communications Manager — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Unified Communications Manager. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Unified Communications Manager — versions per vendor advisory"
     ],
@@ -153269,7 +153269,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -153380,7 +153380,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Gogs Gogs — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Gogs. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Gogs Gogs — versions per vendor advisory"
     ],
@@ -153491,7 +153491,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Office — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Office. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Office — versions per vendor advisory"
     ],
@@ -153602,7 +153602,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Hewlett Packard Enterprise (HPE) OneView — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Hewlett Packard Enterprise (HPE) OneView. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Hewlett Packard Enterprise (HPE) OneView — versions per vendor advisory"
     ],
@@ -153714,7 +153714,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Digiever DS-2105 Pro — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Digiever DS-2105 Pro. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Digiever DS-2105 Pro — versions per vendor advisory"
     ],
@@ -153826,7 +153826,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "WatchGuard Firebox — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "WatchGuard Firebox. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "WatchGuard Firebox — versions per vendor advisory"
     ],
@@ -153937,7 +153937,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "ASUS Live Update — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "ASUS Live Update. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "ASUS Live Update — versions per vendor advisory"
     ],
@@ -154048,7 +154048,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SonicWall SMA1000 appliance — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SonicWall SMA1000 appliance. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SonicWall SMA1000 appliance — versions per vendor advisory"
     ],
@@ -154161,7 +154161,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Multiple Products — versions per vendor advisory"
     ],
@@ -154272,7 +154272,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet Multiple Products — versions per vendor advisory"
     ],
@@ -154384,7 +154384,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Gladinet CentreStack and Triofox — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Gladinet CentreStack and Triofox. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Gladinet CentreStack and Triofox — versions per vendor advisory"
     ],
@@ -154498,7 +154498,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Sierra Wireless AirLink ALEOS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Sierra Wireless AirLink ALEOS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sierra Wireless AirLink ALEOS — versions per vendor advisory"
     ],
@@ -154612,7 +154612,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "OSGeo GeoServer — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "OSGeo GeoServer. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "OSGeo GeoServer — versions per vendor advisory"
     ],
@@ -154724,7 +154724,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "RARLAB WinRAR — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "RARLAB WinRAR. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "RARLAB WinRAR — versions per vendor advisory"
     ],
@@ -154836,7 +154836,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -154947,7 +154947,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "D-Link Routers — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "D-Link Routers. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "D-Link Routers — versions per vendor advisory"
     ],
@@ -155058,7 +155058,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Array Networks  ArrayOS AG — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Array Networks ArrayOS AG. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Array Networks  ArrayOS AG — versions per vendor advisory"
     ],
@@ -155171,7 +155171,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Meta React Server Components — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Meta React Server Components. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Meta React Server Components — versions per vendor advisory"
     ],
@@ -155285,7 +155285,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "OpenPLC ScadaBR — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "OpenPLC ScadaBR. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "OpenPLC ScadaBR — versions per vendor advisory"
     ],
@@ -155397,7 +155397,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Android Framework — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Android Framework. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Android Framework — versions per vendor advisory"
     ],
@@ -155508,7 +155508,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Android Framework — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Android Framework. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Android Framework — versions per vendor advisory"
     ],
@@ -155618,7 +155618,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "OpenPLC ScadaBR — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "OpenPLC ScadaBR. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "OpenPLC ScadaBR — versions per vendor advisory"
     ],
@@ -155729,7 +155729,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Oracle Fusion Middleware — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Oracle Fusion Middleware. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Oracle Fusion Middleware — versions per vendor advisory"
     ],
@@ -155841,7 +155841,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Chromium V8 — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Chromium V8. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chromium V8 — versions per vendor advisory"
     ],
@@ -155952,7 +155952,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet FortiWeb — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet FortiWeb. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet FortiWeb — versions per vendor advisory"
     ],
@@ -156064,7 +156064,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet FortiWeb — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet FortiWeb. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet FortiWeb — versions per vendor advisory"
     ],
@@ -156175,7 +156175,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Gladinet Triofox — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Gladinet Triofox. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Gladinet Triofox — versions per vendor advisory"
     ],
@@ -156287,7 +156287,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -156397,7 +156397,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "WatchGuard Firebox — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "WatchGuard Firebox. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "WatchGuard Firebox — versions per vendor advisory"
     ],
@@ -156508,7 +156508,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Samsung Mobile Devices — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Samsung Mobile Devices. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Samsung Mobile Devices — versions per vendor advisory"
     ],
@@ -156619,7 +156619,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "CWP Control Web Panel — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "CWP Control Web Panel. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "CWP Control Web Panel — versions per vendor advisory"
     ],
@@ -156731,7 +156731,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Gladinet CentreStack and Triofox — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Gladinet CentreStack and Triofox. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Gladinet CentreStack and Triofox — versions per vendor advisory"
     ],
@@ -156843,7 +156843,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Broadcom VMware Aria Operations and VMware Tools — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Broadcom VMware Aria Operations and VMware Tools. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Broadcom VMware Aria Operations and VMware Tools — versions per vendor advisory"
     ],
@@ -156954,7 +156954,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "XWiki Platform — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "XWiki Platform. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "XWiki Platform — versions per vendor advisory"
     ],
@@ -157066,7 +157066,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Dassault Systèmes DELMIA Apriso — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Dassault Systèmes DELMIA Apriso. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Dassault Systèmes DELMIA Apriso — versions per vendor advisory"
     ],
@@ -157178,7 +157178,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Dassault Systèmes DELMIA Apriso — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Dassault Systèmes DELMIA Apriso. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Dassault Systèmes DELMIA Apriso — versions per vendor advisory"
     ],
@@ -157290,7 +157290,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Adobe Commerce and Magento — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Adobe Commerce and Magento. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Adobe Commerce and Magento — versions per vendor advisory"
     ],
@@ -157402,7 +157402,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -157513,7 +157513,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Motex LANSCOPE Endpoint Manager — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Motex LANSCOPE Endpoint Manager. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Motex LANSCOPE Endpoint Manager — versions per vendor advisory"
     ],
@@ -157625,7 +157625,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -157740,7 +157740,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Kentico Xperience CMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Kentico Xperience CMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Kentico Xperience CMS — versions per vendor advisory"
     ],
@@ -157852,7 +157852,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Kentico Xperience CMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Kentico Xperience CMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Kentico Xperience CMS — versions per vendor advisory"
     ],
@@ -157964,7 +157964,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -158076,7 +158076,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Oracle E-Business Suite — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Oracle E-Business Suite. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Oracle E-Business Suite — versions per vendor advisory"
     ],
@@ -158188,7 +158188,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Adobe Experience Manager (AEM) Forms — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Adobe Experience Manager (AEM) Forms. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Adobe Experience Manager (AEM) Forms — versions per vendor advisory"
     ],
@@ -158300,7 +158300,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "IGEL IGEL OS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "IGEL OS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "IGEL IGEL OS — versions per vendor advisory"
     ],
@@ -158411,7 +158411,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -158521,7 +158521,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -158632,7 +158632,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SKYSEA Client View — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SKYSEA Client View. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SKYSEA Client View — versions per vendor advisory"
     ],
@@ -158744,7 +158744,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Grafana Labs Grafana — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Grafana Labs Grafana. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Grafana Labs Grafana — versions per vendor advisory"
     ],
@@ -158856,7 +158856,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor Zimbra Collaboration Suite (ZCS) — versions per vendor advisory"
     ],
@@ -158967,7 +158967,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Linux Kernel — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Linux Kernel. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Linux Kernel — versions per vendor advisory"
     ],
@@ -159080,7 +159080,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Internet Explorer — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Internet Explorer. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Internet Explorer — versions per vendor advisory"
     ],
@@ -159191,7 +159191,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -159301,7 +159301,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -159412,7 +159412,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -159523,7 +159523,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Mozilla Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Mozilla Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Mozilla Multiple Products — versions per vendor advisory"
     ],
@@ -159634,7 +159634,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Oracle E-Business Suite — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Oracle E-Business Suite. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Oracle E-Business Suite — versions per vendor advisory"
     ],
@@ -159747,7 +159747,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "GNU GNU Bash — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "GNU Bash. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "GNU GNU Bash — versions per vendor advisory"
     ],
@@ -159862,7 +159862,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Jenkins Jenkins — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Jenkins. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Jenkins Jenkins — versions per vendor advisory"
     ],
@@ -159974,7 +159974,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Juniper ScreenOS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Juniper ScreenOS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Juniper ScreenOS — versions per vendor advisory"
     ],
@@ -160086,7 +160086,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Samsung Mobile Devices — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Samsung Mobile Devices. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Samsung Mobile Devices — versions per vendor advisory"
     ],
@@ -160197,7 +160197,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Smartbedded Meteobridge — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Smartbedded Meteobridge. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Smartbedded Meteobridge — versions per vendor advisory"
     ],
@@ -160310,7 +160310,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Sudo Sudo — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Sudo. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sudo Sudo — versions per vendor advisory"
     ],
@@ -160421,7 +160421,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Libraesva Email Security Gateway — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Libraesva Email Security Gateway. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Libraesva Email Security Gateway — versions per vendor advisory"
     ],
@@ -160533,7 +160533,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortra GoAnywhere MFT — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortra GoAnywhere MFT. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortra GoAnywhere MFT — versions per vendor advisory"
     ],
@@ -160647,7 +160647,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco IOS and IOS XE — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco IOS and IOS XE. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco IOS and IOS XE — versions per vendor advisory"
     ],
@@ -160759,7 +160759,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Adminer Adminer — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Adminer. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Adminer Adminer — versions per vendor advisory"
     ],
@@ -160870,7 +160870,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — versions per vendor advisory"
     ],
@@ -160986,7 +160986,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense — versions per vendor advisory"
     ],
@@ -161102,7 +161102,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Dassault Systèmes DELMIA Apriso — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Dassault Systèmes DELMIA Apriso. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Dassault Systèmes DELMIA Apriso — versions per vendor advisory"
     ],
@@ -161214,7 +161214,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Android Runtime — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Android Runtime. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Android Runtime — versions per vendor advisory"
     ],
@@ -161324,7 +161324,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Sitecore Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Sitecore Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sitecore Multiple Products — versions per vendor advisory"
     ],
@@ -161436,7 +161436,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TP-Link TL-WR841N — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TP-Link TL-WR841N. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "TP-Link TL-WR841N — versions per vendor advisory"
     ],
@@ -161548,7 +161548,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TP-Link Multiple Routers — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TP-Link Multiple Routers. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "TP-Link Multiple Routers — versions per vendor advisory"
     ],
@@ -161660,7 +161660,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TP-Link TL-WA855RE — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TP-Link TL-WA855RE. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "TP-Link TL-WA855RE — versions per vendor advisory"
     ],
@@ -161773,7 +161773,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Meta Platforms WhatsApp — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Meta Platforms WhatsApp. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Meta Platforms WhatsApp — versions per vendor advisory"
     ],
@@ -161884,7 +161884,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Sangoma FreePBX — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Sangoma FreePBX. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sangoma FreePBX — versions per vendor advisory"
     ],
@@ -161997,7 +161997,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Citrix NetScaler — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Citrix NetScaler. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Citrix NetScaler — versions per vendor advisory"
     ],
@@ -162108,7 +162108,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Git Git — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Git. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Git Git — versions per vendor advisory"
     ],
@@ -162224,7 +162224,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Citrix Session Recording — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Citrix Session Recording. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Citrix Session Recording — versions per vendor advisory"
     ],
@@ -162335,7 +162335,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Citrix Session Recording — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Citrix Session Recording. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Citrix Session Recording — versions per vendor advisory"
     ],
@@ -162447,7 +162447,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Trend Micro Apex One — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Trend Micro Apex One. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Trend Micro Apex One — versions per vendor advisory"
     ],
@@ -162559,7 +162559,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "N-able N-Central — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "N-able N-Central. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "N-able N-Central — versions per vendor advisory"
     ],
@@ -162671,7 +162671,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "N-able N-Central — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "N-able N-Central. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "N-able N-Central — versions per vendor advisory"
     ],
@@ -162783,7 +162783,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "RARLAB WinRAR — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "RARLAB WinRAR. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "RARLAB WinRAR — versions per vendor advisory"
     ],
@@ -162895,7 +162895,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Office — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Office. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Office — versions per vendor advisory"
     ],
@@ -163006,7 +163006,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Internet Explorer — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Internet Explorer. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Internet Explorer — versions per vendor advisory"
     ],
@@ -163117,7 +163117,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "D-Link DCS-2530L and DCS-2670L Devices — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "D-Link DCS-2530L and DCS-2670L Devices. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "D-Link DCS-2530L and DCS-2670L Devices — versions per vendor advisory"
     ],
@@ -163231,7 +163231,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "D-Link DCS-2530L and DCS-2670L Devices — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "D-Link DCS-2530L and DCS-2670L Devices. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "D-Link DCS-2530L and DCS-2670L Devices — versions per vendor advisory"
     ],
@@ -163344,7 +163344,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "D-Link DNR-322L — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "D-Link DNR-322L. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "D-Link DNR-322L — versions per vendor advisory"
     ],
@@ -163455,7 +163455,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "PaperCut NG/MF — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "PaperCut NG/MF. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "PaperCut NG/MF — versions per vendor advisory"
     ],
@@ -163566,7 +163566,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Identity Services Engine — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Identity Services Engine. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Identity Services Engine — versions per vendor advisory"
     ],
@@ -163678,7 +163678,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Cisco Identity Services Engine — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Cisco Identity Services Engine. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Identity Services Engine — versions per vendor advisory"
     ],
@@ -163790,7 +163790,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SysAid SysAid On-Prem — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SysAid On-Prem. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SysAid SysAid On-Prem — versions per vendor advisory"
     ],
@@ -163901,7 +163901,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SysAid SysAid On-Prem — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SysAid On-Prem. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SysAid SysAid On-Prem — versions per vendor advisory"
     ],
@@ -164012,7 +164012,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Chromium — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Chromium. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chromium — versions per vendor advisory"
     ],
@@ -164124,7 +164124,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "CrushFTP CrushFTP — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "CrushFTP. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "CrushFTP CrushFTP — versions per vendor advisory"
     ],
@@ -164236,7 +164236,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft SharePoint — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft SharePoint. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft SharePoint — versions per vendor advisory"
     ],
@@ -164352,7 +164352,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft SharePoint — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft SharePoint. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft SharePoint — versions per vendor advisory"
     ],
@@ -164467,7 +164467,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft SharePoint — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft SharePoint. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft SharePoint — versions per vendor advisory"
     ],
@@ -164582,7 +164582,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet FortiWeb — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet FortiWeb. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet FortiWeb — versions per vendor advisory"
     ],
@@ -164693,7 +164693,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Wing FTP Server Wing FTP Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Wing FTP Server Wing FTP Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Wing FTP Server Wing FTP Server — versions per vendor advisory"
     ],
@@ -164805,7 +164805,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Citrix NetScaler ADC and Gateway — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Citrix NetScaler ADC and Gateway. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Citrix NetScaler ADC and Gateway — versions per vendor advisory"
     ],
@@ -164918,7 +164918,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor Zimbra Collaboration Suite (ZCS) — versions per vendor advisory"
     ],
@@ -165031,7 +165031,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Rails Ruby on Rails — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Rails Ruby on Rails. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Rails Ruby on Rails — versions per vendor advisory"
     ],
@@ -165143,7 +165143,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "PHP PHPMailer — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "PHP PHPMailer. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "PHP PHPMailer — versions per vendor advisory"
     ],
@@ -165257,7 +165257,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Looking Glass Multi-Router Looking Glass (MRLG) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Looking Glass Multi-Router Looking Glass (MRLG). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Looking Glass Multi-Router Looking Glass (MRLG) — versions per vendor advisory"
     ],
@@ -165368,7 +165368,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Chromium V8 — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Chromium V8. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chromium V8 — versions per vendor advisory"
     ],
@@ -165479,9 +165479,9 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TeleMessage TM SGNL — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TeleMessage TM SGNL. This entry links no vendor advisory; its sources are CISA's KEV entry and the NVD record.",
     "affected_versions": [
-      "TeleMessage TM SGNL — versions per vendor advisory"
+      "TeleMessage TM SGNL service as operated through 2025-05-05 (per the NVD record); no version range is published"
     ],
     "vector": "TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump.",
     "complexity": "moderate",
@@ -165554,11 +165554,11 @@
     "_kev_short_description": "TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump.",
     "iocs": {
       "behavioral": [
-        "TeleMessage TM SGNL reachable on the network at a version below the fixed release named in the vendor advisory, with a diagnostic/dump surface or verbose errors exposed.",
+        "TeleMessage TM SGNL service reachable on the network with a diagnostic/dump surface or verbose errors exposed. The NVD record covers the service as operated through 2025-05-05 and publishes no version range.",
         "Unauthenticated requests to the TeleMessage (Signal clone) targeting diagnostic endpoints (/heapdump, actuator), core-dump files, or error-triggering inputs.",
         "Retrieval of memory dumps, core files, or error output disclosing credentials or plaintext data, followed by use of the disclosed material elsewhere (KEV-confirmed in-the-wild exploitation)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2025-48928, CISA KEV (added 2025-07-01), and the vendor security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2025-48928 and CISA KEV (added 2025-07-01). This entry links no vendor advisory."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -165583,9 +165583,9 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TeleMessage TM SGNL — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TeleMessage TM SGNL. This entry links no vendor advisory; its sources are CISA's KEV entry and the NVD record.",
     "affected_versions": [
-      "TeleMessage TM SGNL — versions per vendor advisory"
+      "TeleMessage TM SGNL service as operated through 2025-05-05 (per the NVD record); no version range is published"
     ],
     "vector": "TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.",
     "complexity": "moderate",
@@ -165658,11 +165658,11 @@
     "_kev_short_description": "TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.",
     "iocs": {
       "behavioral": [
-        "TeleMessage TM SGNL reachable on the network at a version below the fixed release named in the vendor advisory, with a diagnostic/dump surface or verbose errors exposed.",
+        "TeleMessage TM SGNL service reachable on the network with a diagnostic/dump surface or verbose errors exposed. The NVD record covers the service as operated through 2025-05-05 and publishes no version range.",
         "Unauthenticated requests to the TeleMessage (Signal clone) targeting diagnostic endpoints (/heapdump, actuator), core-dump files, or error-triggering inputs.",
         "Retrieval of memory dumps, core files, or error output disclosing credentials or plaintext data, followed by use of the disclosed material elsewhere (KEV-confirmed in-the-wild exploitation)."
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2025-48927, CISA KEV (added 2025-07-01), and the vendor security advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2025-48927 and CISA KEV (added 2025-07-01). This entry links no vendor advisory."
     },
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-05-29: ATT&CK enrichment (T1190 + T1552 unsecured credentials/data) + IOCs derived from the CWE/product, and a matching zero-day lesson added. CVSS/KEV/vendor_advisories retained from the verified import.",
@@ -165687,7 +165687,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Citrix NetScaler ADC and Gateway — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Citrix NetScaler ADC and Gateway. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Citrix NetScaler ADC and Gateway — versions per vendor advisory"
     ],
@@ -165799,7 +165799,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet FortiOS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet FortiOS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet FortiOS — versions per vendor advisory"
     ],
@@ -165912,7 +165912,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "D-Link DIR-859 Router — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "D-Link DIR-859 Router. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "D-Link DIR-859 Router — versions per vendor advisory"
     ],
@@ -166024,7 +166024,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "AMI MegaRAC SPx — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "AMI MegaRAC SPx. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "AMI MegaRAC SPx — versions per vendor advisory"
     ],
@@ -166137,7 +166137,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Linux Kernel — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Linux Kernel. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Linux Kernel — versions per vendor advisory"
     ],
@@ -166250,7 +166250,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "TP-Link Multiple Routers — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "TP-Link Multiple Routers. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "TP-Link Multiple Routers — versions per vendor advisory"
     ],
@@ -166362,7 +166362,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Apple Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Apple Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apple Multiple Products — versions per vendor advisory"
     ],
@@ -166479,7 +166479,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -166591,7 +166591,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Wazuh Wazuh Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Wazuh Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Wazuh Wazuh Server — versions per vendor advisory"
     ],
@@ -166704,7 +166704,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Roundcube Webmail — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Roundcube Webmail. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Roundcube Webmail — versions per vendor advisory"
     ],
@@ -166816,7 +166816,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Erlang Erlang/OTP — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Erlang/OTP. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Erlang Erlang/OTP — versions per vendor advisory"
     ],
@@ -166930,7 +166930,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Google Chromium V8 — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Google Chromium V8. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chromium V8 — versions per vendor advisory"
     ],
@@ -167042,7 +167042,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Qualcomm Multiple Chipsets — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Qualcomm Multiple Chipsets. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Qualcomm Multiple Chipsets — versions per vendor advisory"
     ],
@@ -167152,7 +167152,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Qualcomm Multiple Chipsets — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Qualcomm Multiple Chipsets. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Qualcomm Multiple Chipsets — versions per vendor advisory"
     ],
@@ -167262,7 +167262,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Qualcomm Multiple Chipsets — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Qualcomm Multiple Chipsets. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Qualcomm Multiple Chipsets — versions per vendor advisory"
     ],
@@ -167372,7 +167372,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "ASUS Routers — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "ASUS Routers. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "ASUS Routers — versions per vendor advisory"
     ],
@@ -167485,7 +167485,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "ConnectWise ScreenConnect — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "ConnectWise ScreenConnect. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "ConnectWise ScreenConnect — versions per vendor advisory"
     ],
@@ -167597,7 +167597,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Craft CMS Craft CMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Craft CMS Craft CMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Craft CMS Craft CMS — versions per vendor advisory"
     ],
@@ -167708,7 +167708,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Craft CMS Craft CMS — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Craft CMS Craft CMS. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Craft CMS Craft CMS — versions per vendor advisory"
     ],
@@ -167820,7 +167820,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "ASUS RT-AX55 Routers — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "ASUS RT-AX55 Routers. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "ASUS RT-AX55 Routers — versions per vendor advisory"
     ],
@@ -167933,7 +167933,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Samsung MagicINFO 9 Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Samsung MagicINFO 9 Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Samsung MagicINFO 9 Server — versions per vendor advisory"
     ],
@@ -168044,7 +168044,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "ZKTeco BioTime — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "ZKTeco BioTime. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "ZKTeco BioTime — versions per vendor advisory"
     ],
@@ -168156,7 +168156,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Synacor Zimbra Collaboration Suite (ZCS) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Synacor Zimbra Collaboration Suite (ZCS). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Synacor Zimbra Collaboration Suite (ZCS) — versions per vendor advisory"
     ],
@@ -168269,7 +168269,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Srimax Output Messenger — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Srimax Output Messenger. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Srimax Output Messenger — versions per vendor advisory"
     ],
@@ -168380,7 +168380,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "MDaemon Email Server — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "MDaemon Email Server. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "MDaemon Email Server — versions per vendor advisory"
     ],
@@ -168493,7 +168493,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Ivanti Endpoint Manager Mobile (EPMM) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Ivanti Endpoint Manager Mobile (EPMM). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Ivanti Endpoint Manager Mobile (EPMM) — versions per vendor advisory"
     ],
@@ -168605,7 +168605,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Ivanti Endpoint Manager Mobile (EPMM) — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Ivanti Endpoint Manager Mobile (EPMM). The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Ivanti Endpoint Manager Mobile (EPMM) — versions per vendor advisory"
     ],
@@ -168717,7 +168717,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "SAP NetWeaver — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "SAP NetWeaver. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SAP NetWeaver — versions per vendor advisory"
     ],
@@ -168829,7 +168829,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "DrayTek Vigor Routers — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "DrayTek Vigor Routers. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "DrayTek Vigor Routers — versions per vendor advisory"
     ],
@@ -168943,7 +168943,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Fortinet Multiple Products — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Fortinet Multiple Products. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Fortinet Multiple Products — versions per vendor advisory"
     ],
@@ -169054,7 +169054,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -169164,7 +169164,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -169275,7 +169275,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -169386,7 +169386,7 @@
     "ai_assisted_notes": "Bulk-imported KEV entry — weaponization-channel attribution not in KEV.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV listing is CISA's confirmed-exploitation attestation. The dateAdded is the formal KEV listing date; the actual in-wild observation may predate it by weeks.",
-    "affected": "Microsoft Windows — see vendor advisory linked in verification_sources for affected version ranges.",
+    "affected": "Microsoft Windows. The affected version ranges are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Microsoft Windows — versions per vendor advisory"
     ],
@@ -171679,7 +171679,7 @@
     "ai_assisted_notes": "No AI-assisted weaponization; a classic missing-authorization kernel flaw exploited through cgroups v1 release_agent to break container/namespace isolation.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "CISA added CVE-2022-0492 to the Known Exploited Vulnerabilities catalog on 2026-06-02 (due 2026-06-05) - confirmed in-the-wild exploitation. The flaw is a high-value container-escape primitive: a containerized or unprivileged-namespace process can reach root in the host's initial namespace, making it a routine post-compromise lateral-movement step against misconfigured (no AppArmor/SELinux/seccomp) container hosts.",
-    "affected": "Linux kernel 2.6.24 through the fixed releases in each maintained series (see affected_versions); distribution kernels based on these (Debian 9/10/11, RHEL 8 variants, Ubuntu 14.04-22.04, Fedora 35) and embedded firmware (e.g. NetApp HCI/SolidFire) until patched.",
+    "affected": "Linux kernel 2.6.24 through the fixed releases in each maintained series (listed under this entry's affected versions); distribution kernels based on these (Debian 9/10/11, RHEL 8 variants, Ubuntu 14.04-22.04, Fedora 35) and embedded firmware (e.g. NetApp HCI/SolidFire) until patched.",
     "affected_versions": [
       "Linux kernel 2.6.24 to < 4.9.301",
       "Linux kernel 4.10 to < 4.14.266",
@@ -173891,7 +173891,7 @@
     "ai_assisted_notes": "In-the-wild webshell deployment; no AI-build attribution.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2026-06-25, due 2026-06-28). First-ever confirmed real-world exploitation of PTC Windchill; attackers deploy persistent JSP webshells for remote command execution and data exfiltration. No named actor attribution.",
-    "affected": "PTC Windchill and FlexPLM — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "PTC Windchill and FlexPLM. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "PTC Windchill/FlexPLM all versions up to and including 11.0",
       "Affected releases across the 11.1, 11.2, 12.0, 12.1 and 13.0 branches (see PTC advisory for fixed builds per branch)"
@@ -173997,7 +173997,7 @@
     "ai_assisted_notes": "Public PoC exploit code released by security researchers; no AI-build attribution.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added ~2026-06-24). Defused reported in-the-wild exploitation the weekend of 2026-06-21/22, the first credible ITW claim; public PoC available. No named actor attribution.",
-    "affected": "Cisco Unified Communications Manager — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Cisco Unified Communications Manager. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Unified CM / Unified CM SME prior to 14SU6",
       "Cisco Unified CM / Unified CM SME 15 prior to 15SU5",
@@ -174102,7 +174102,7 @@
     "ai_assisted_notes": "No AI-build attribution for the in-the-wild exploit.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2026-06-23, due 2026-06-26). Actively exploited against internet-facing/network-accessible EDS5000 device servers. No named actor; the device bridges serial OT assets (PLCs/RTUs) to IP, so exploitation enables OT pivot.",
-    "affected": "Lantronix EDS5000 — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Lantronix EDS5000. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Lantronix EDS5000 firmware 2.1.0.0R3 and earlier",
       "Fixed in firmware 2.2.0.0R1"
@@ -174208,7 +174208,7 @@
     "ai_assisted_notes": "In-the-wild weaponization is a conventional Mirai/Gafgyt-derived loader; no AI-build attribution.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2026-06-23, due 2026-06-26). Command-injection leg of the unauthenticated root-RCE chain (with CVE-2026-34908 + CVE-2026-34909) used to deploy the azsxd/Mirai-derived IoT botnet. Opportunistic mass-exploitation; no named APT.",
-    "affected": "Ubiquiti UniFi OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Ubiquiti UniFi OS. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "UniFi OS Server builds prior to 5.0.8 (unifi-core 5.0.153)",
       "UniFi OS consoles/devices (UDM, UDM-Pro, UDM-SE, Express, UNVR, UNAS families) prior to the SAB-064 fixes"
@@ -174315,7 +174315,7 @@
     "ai_assisted_notes": "No evidence the in-the-wild exploit was AI-built. The only AI reference in the reporting is defensive: the pwndefend.com exploitation writeup states its own reverse-engineering analysis of the botnet payload was \"made with Claude\" (https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/) — that is the defender's analysis tooling, not weaponization of the exploit. No source attributes the exploit chain's construction to an AI system.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation (added to CISA KEV 2026-06-23). Exploited in the wild from on/around 2026-05-21, coinciding with the SAB-064 publication. The path traversal is chained with CVE-2026-34908 (access-control bypass) and CVE-2026-34910 (command injection) to achieve unauthenticated root RCE, which operators use to deploy a Mirai/Gafgyt-derived IoT botnet (\"azsxd v2.0\", loaded by a shell script \"zok\"), tracked via the infection-vector tag \"unifi.exploit\". No named APT/state actor or commercial spyware vendor attribution; the botnet operator is unidentified.",
-    "affected": "Ubiquiti UniFi OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Ubiquiti UniFi OS. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "UniFi OS Server: versions prior to 5.0.8 (fixed in 5.0.8, unifi-core 5.0.153)",
       "UNVR-G2 and UNVR-G2-Pro: versions prior to 5.1.12",
@@ -174426,7 +174426,7 @@
     "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public unauthenticated RCE chain and a safe detection script were authored by Bishop Fox researchers (human); in-the-wild weaponization is a conventional Mirai/Gafgyt-derived loader (\"azsxd\" v2.0) with no AI-build attribution.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2026-06-23, due 2026-06-26). Opportunistic mass-exploitation: a Mirai/Gafgyt-derived botnet variant named \"azsxd\" (v2.0) chains CVE-2026-34908 (access-control bypass) + CVE-2026-34909 (path traversal) + CVE-2026-34910 (command injection) for unauthenticated root RCE on UniFi OS Server. First in-the-wild exploitation observed within days of public PoC tooling release following Ubiquiti advisory SAB-064 (~2026-05-21). No named APT/state actor attributed; described as opportunistic mass-exploitation.",
-    "affected": "Ubiquiti UniFi OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Ubiquiti UniFi OS. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "UniFi OS Server builds at or below 5.0.6 (unifi-core 5.0.126) — affected",
       "Fixed in UniFi OS Server 5.0.8 or later (unifi-core 5.0.153)",
@@ -174535,7 +174535,7 @@
     "ai_assisted_notes": "watchTowr Labs states their public exploit was built with assistance from \"Project Red,\" their internal LLM-driven vulnerability reproduction harness, which was used to identify the vulnerable API endpoint and craft exploitation requests; human researchers Piotr Bazydlo and Yordan Ganchev performed the analysis and finalized the pg_dump/pg_restore chain (https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/, corroborated by https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html). Caveat: this named-AI assistance applies to watchTowr's research/PoC, not to any confirmed in-the-wild attacker tooling.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2026-06-18, due 2026-06-21). Splunk PSIRT became aware of limited in-the-wild exploitation and updated SVD-2026-0603 on 2026-06-18; in-the-wild activity was independently confirmed by Resecurity. Exploitation began within days of the 2026-06-10 vendor disclosure and watchTowr's ~2026-06-12 public PoC. No public threat-actor or named-campaign attribution as of reporting.",
-    "affected": "Splunk Enterprise — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Splunk Enterprise. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Splunk Enterprise 10.2.0 through 10.2.3 (fixed in 10.2.4)",
       "Splunk Enterprise 10.0.0 through 10.0.6 (fixed in 10.0.7)",
@@ -174645,7 +174645,7 @@
     "ai_assisted_notes": "No evidence the exploit was AI-built. Weaponization is a publicly published, hand-written Nuclei template plus a GitHub reproduction lab demonstrating the three-step unauthenticated chain; no source attributes exploit development to any AI tool or agent.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed active exploitation (added 2026-06-16, due 2026-06-19). Mass automated exploitation with public working exploit code (Nuclei template + GitHub reproduction lab); attackers import a rogue JCE editor profile that permits executable uploads, then drop a PHP web shell to the images/ directory for a persistent backdoor. One report describes hundreds of sites already compromised. No named threat actor / APT attribution and no public first-observed-in-wild date; Joomla warns that patching closes the entry point but does not clean an already-compromised site.",
-    "affected": "Widget Factory (Joomla Content Editor) Joomla Content Editor  — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Widget Factory (Joomla Content Editor) Joomla Content Editor . The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "JCE (Joomla Content Editor) 1.0.0 through 2.9.99.4 — vulnerable",
       "Branches 2.7.x, 2.8.x, and 2.9.x require patching; 2.6.x reportedly not affected by default",
@@ -174755,7 +174755,7 @@
     "ai_assisted_notes": "No primary source indicates the exploit was AI-built. Two public PoC exploits exist (e.g. github.com/fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit) but are human-authored; no AI weaponization is claimed or evidenced.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild beginning May 2026 (KEV-confirmed; CISA added it 2026-06-15 under BOD 26-04 with a 2026-06-18 due date). Namecheap's team reported the flaw to LiteSpeed on 2026-05-31, and cPanel proactively pushed an emergency uninstall command for the plugin the same day. No public threat-actor, campaign, or ransomware attribution; known_ransomware=Unknown. Two public proof-of-concept exploits are available on GitHub. Primary risk is a single compromised tenant turning into a server-wide, cross-account incident on multi-tenant shared hosting.",
-    "affected": "LiteSpeed cPanel Plugin — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "LiteSpeed cPanel Plugin. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "LiteSpeed cPanel plugin (user-end): all versions before 2.4.8 - fixed in 2.4.8",
       "LiteSpeed WHM PlugIn: before 5.3.2.0 (per NVD); vendor advisory directs upgrade to WHM plugin v5.3.2.1 or higher, which bundles cPanel plugin v2.4.8",
@@ -174863,7 +174863,7 @@
     "ai_assisted_notes": "No source describes the exploit as AI-built. A public PoC exists (GitHub: fevar54/CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-) but no AI tooling is credited with developing it or the in-the-wild exploit.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation (CISA KEV listing 2026-06-15, due 2026-06-29). Cisco PSIRT became aware of limited in-the-wild exploitation in June 2026; it was exploited as a zero-day before fixed software was broadly deployed. No public threat-actor, campaign, or spyware-vendor attribution. Reported as one of multiple Cisco SD-WAN Manager flaws targeted in 2026, signaling sustained targeting of network-management infrastructure.",
-    "affected": "Cisco Catalyst SD-WAN Manager — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Cisco Catalyst SD-WAN Manager. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Catalyst SD-WAN Manager 20.9.9.1 and earlier (fixed in 20.9.9.2)",
       "20.12.7.1 and earlier (fixed in 20.12.7.2)",
@@ -174974,7 +174974,7 @@
     "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public exploit chain was hand-built by watchTowr Labs (human researchers) and released as a GitHub PoC (https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028); a Metasploit module followed. No primary source credits an AI system with weaponization.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation; no public actor attribution. CISA added CVE-2025-34028 to the KEV catalog on 2025-05-02, about a week after public disclosure (advisory + PoC published 2025-04-23/24). No named threat actor, campaign, or spyware vendor is tied specifically to this CVE in public reporting; exploitation was opportunistic/mass-scanning-driven, accelerated by the public watchTowr PoC and a subsequent Metasploit module. (Distinct from the earlier nation-state-linked Commvault SaaS/Metallic intrusion associated with CVE-2025-3928.)",
-    "affected": "Commvault Command Center — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Commvault Command Center. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Commvault Command Center Innovation Release 11.38.0 through 11.38.19 (Linux and Windows)",
       "NVD-stated affected range: 11.38.0 to 11.38.20",
@@ -175084,7 +175084,7 @@
     "ai_assisted_notes": "No primary source indicates the in-the-wild exploit chain or public PoCs were AI-built. The campaign was reconstructed from forensic artifacts by human IR/ethical-hacking teams; public exploit/analysis (Rapid7, Medium PoC walkthroughs) is human-authored with no AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation; no public actor/campaign attribution. Reconstructed by Orange Cyberdefense (SensePost) from a forensic IR engagement: reconnaissance began 2025-02-10 (repeated hits to Craft CMS /index.php?p=admin/actions/assets/generate-transform) and the first observed server compromise was 2025-02-14, exploited in the wild February through April 2025. Used as the object-injection sink in a chain with Craft CMS pre-auth RCE CVE-2025-32432; the threat actor is described only as \"a threat actor\" with no named group/spyware-vendor attribution. Used to deploy web shells, overwrite legitimate files, and exfiltrate sensitive data.",
-    "affected": "Yii framework Yii — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Yii framework Yii. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Yii 2 framework (yiisoft/yii2) before 2.0.52",
       "Fixed in Yii 2.0.52",
@@ -175192,7 +175192,7 @@
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. The exploitation technique was authored manually by Orange Tsai/DEVCORE and published with case studies; the in-the-wild weaponization by UNC6148 against SonicWall SMA100 (GTIG reporting) describes hands-on-keyboard operation with stolen credentials/OTP seeds and a custom rootkit (OVERSTEP), with no AI tooling attributed.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2025-05-01). Exploited by UNC6148, a suspected financially-motivated actor tracked by Google Threat Intelligence Group (GTIG), against internet-facing SonicWall SMA 100 series appliances (which bundle Apache httpd). UNC6148 used CVE-2024-38475 as an unauthenticated path traversal to exfiltrate SQLite databases containing admin credentials and OTP seeds, then replayed those secrets to regain access to fully-patched/EoL appliances and deploy the previously-unknown OVERSTEP user-mode rootkit/backdoor. GTIG observed scanning since at least October 2024 and credential exfiltration as early as January 2025; activity overlaps with Abyss-branded ransomware and World Leaks extortion. watchTowr separately published a SonicBoom chain combining CVE-2024-38475 with CVE-2023-44221 for full SMA100 compromise.",
-    "affected": "Apache HTTP Server — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Apache HTTP Server. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apache HTTP Server 2.4.0 through 2.4.59 (all 2.4.x up to and including 2.4.59)",
       "Affected configurations: server-context RewriteRule substitutions whose first segment is a backreference or variable (some unsafe RewriteRules)",
@@ -175300,7 +175300,7 @@
     "ai_assisted_notes": "No source indicates AI-assisted exploit development. The public end-to-end exploit chain (codenamed \"SonicBoom\") was researched, built, and documented by human analysts at watchTowr Labs. Source: https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-cve-2024-38475/",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation (CISA added 2025-05-01; SonicWall publicly confirmed active in-the-wild exploitation ~2025-04-29). No public threat-actor or campaign attribution by the vendor or CISA. watchTowr Labs coined \"SonicBoom\" for the demonstrated exploit chain (a researcher codename, not a named adversary). In the wild the post-auth requirement is satisfied by chaining CVE-2024-38475 (an Apache mod_rewrite path-mapping/auth-bypass flaw in the SMA100) to leak a logged-in administrator's session token, then using CVE-2023-44221 for command execution.",
-    "affected": "SonicWall SMA100 Appliances — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "SonicWall SMA100 Appliances. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SonicWall SMA 100 series (SMA 200, 210, 400, 410, 500v) running firmware 10.2.1.9-57sv and earlier — affected",
       "Fixed in firmware 10.2.1.10-62sv (released 2023-12-04) and later",
@@ -175408,7 +175408,7 @@
     "ai_assisted_notes": "No public exploit code or PoC exists, and no source indicates AI-assisted exploit development. Exploitation is KEV-confirmed in-the-wild but no weaponization tooling, exploit author, or AI-build claim has been published.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation (CISA KEV 2025-04-28). Broadcom's advisory explicitly states the vulnerability \"has been actively exploited in the field.\" No public threat-actor, campaign, or spyware-vendor attribution; no first-observed-in-wild date has been disclosed. Exploitation is constrained to actors who already hold a valid admin-level Fabric OS account on the SAN switch.",
-    "affected": "Broadcom (Brocade) Brocade Fabric OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Broadcom (Brocade) Brocade Fabric OS. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Brocade Fabric OS 9.1.0 through 9.1.1d6 (inclusive) — affected",
       "Fixed in Brocade Fabric OS 9.1.1d7",
@@ -175517,7 +175517,7 @@
     "ai_assisted_notes": "No primary source attributes the exploit to AI-assisted development. The in-the-wild exploitation is described as a hand-crafted malicious HTTP request against the Active! Mail webmail front-end; no public weaponized PoC and no AI-tooling claim exists in the JVN advisory, vendor note, JPCERT/CC reporting, or security press (BleepingComputer, SecurityAffairs).",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited as a zero-day against Japanese organizations, primarily mail/hosting providers. IIJ (Internet Initiative Japan) detected attacks on 2025-04-15, before the 2025-04-18 vendor disclosure; subsequent forensics indicate some systems were compromised as early as August 2024 (8+ months of zero-day use). Impacted providers include IIJ Secure MX, Kagoya Japan, and WADAX. The IIJ Secure MX breach exposed ~311,288 email accounts and 488 cloud-admin credentials. KEV-confirmed exploitation; no public threat-actor/APT attribution.",
-    "affected": "Qualitia Active! Mail — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Qualitia Active! Mail. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Active! mail 6 BuildInfo 6.60.05008561 and earlier (all Active! mail 6 builds up to and including 6.60.05008561)",
       "Fixed in Active! mail 6 BuildInfo 6.60.06008562"
@@ -175623,7 +175623,7 @@
     "ai_assisted_notes": "No primary source attributes the exploit/webshell tooling to any AI system. The observed weaponization was conventional: an authenticated actor wrote and executed .aspx webshells on the Commvault Web Server, then pivoted to stored Azure/M365 application secrets. No AI-assisted exploit development is reported.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited as a zero-day by a suspected nation-state threat actor in the Commvault Metallic (SaaS/Azure) breach. Microsoft notified Commvault of the activity on 2025-02-20; the actor deployed webshells via the zero-day to gain persistent remote access and accessed Commvault-held Azure/M365 application credentials (client secrets) used for customer integrations, enabling service-principal impersonation into customer M365 tenants. No specific named APT group has been publicly attributed by CISA or Commvault. KEV-confirmed exploitation; added to CISA KEV 2025-04-28. CISA published an updated advisory with IOCs on 2025-05-22.",
-    "affected": "Commvault Web Server — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Commvault Web Server. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Commvault 11.36.0 through 11.36.45 (Windows and Linux) — fixed in 11.36.46",
       "Commvault 11.32.0 through 11.32.88 (Windows and Linux) — fixed in 11.32.89",
@@ -175731,7 +175731,7 @@
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. Public PoCs are hand-authored XML .library-ms files published to Exploit-DB (52280, 52478, 52480) and the seclists full-disclosure list; the weaponized campaign samples are simple crafted .library-ms/.url files delivered via malspam, with no reporting of AI involvement in their creation.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation. Check Point Research observed the \"NTLM Exploits Bomb\" malspam campaign first in the wild on ~19-21 March 2025 (eight days after the 11 March 2025 patch), targeting Polish and Romanian government and private institutions via Dropbox-hosted ZIP archives. One NTLM-collection SMB server used in the campaign (159.196.128[.]120) was previously attributed by HarfangLab to APT28 / Fancy Bear / Forest Blizzard (Russian GRU state-sponsored). The closely related predecessor flaw CVE-2024-43451 was exploited by Russia-affiliated UAC-0194; multiple groups have leveraged this NTLM-leak class.",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "All supported Windows releases prior to the 2025-03-11 (March 2025) cumulative security update are affected",
       "Windows 10 Version 1507 — fixed by KB5053618",
@@ -175845,7 +175845,7 @@
     "ai_assisted_notes": "No public source indicates the exploit was AI-built. This was a mercenary/commercial-spyware-grade zero-click iMessage chain consistent with human exploit-development tradecraft; no named AI tooling is referenced in any primary or secondary reporting.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2025-04-17). Apple states the issue \"may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.\" It served as the kernel Pointer-Authentication-bypass / privilege-escalation stage of a zero-click iMessage exploit chain paired with CVE-2025-31200 (CoreAudio RCE), first patched 2025-04-16 in iOS 18.4.1. Widely assessed as mercenary/commercial spyware activity against high-risk individuals (journalists, activists/dissidents, diplomats, executives). No public named threat-actor or spyware-vendor attribution.",
-    "affected": "Apple Multiple Products — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Apple Multiple Products. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "iOS and iPadOS before 18.4.1",
       "macOS Sequoia before 15.4.1",
@@ -175953,7 +175953,7 @@
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. The in-the-wild exploitation matches the commercial/mercenary-spyware pattern (zero-click iMessage delivery against targeted high-risk individuals, co-reported by Google TAG). No primary source attributes the exploit chain to any AI tooling.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploitation (added 2025-04-17). Apple states the issue \"may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1\" — the commercial/mercenary-spyware targeting pattern. Co-reported by Google Threat Analysis Group, which tracks commercial surveillance vendors (CSVs); reporting links the activity to targeting of journalists/activists/diplomats. Exploited as part of a zero-click iMessage exploit chain alongside CVE-2025-31201 (PAC bypass / arbitrary read-write). No specific named threat actor or spyware vendor is publicly attributed to this CVE; patched April 16, 2025.",
-    "affected": "Apple Multiple Products — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Apple Multiple Products. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "iOS and iPadOS before 18.4.1 (iPhone XS and later; iPad Pro 13-inch, iPad Pro 13.9-inch 3rd gen and later, iPad Pro 11-inch 1st gen and later, iPad Air 3rd gen and later, iPad 7th gen and later, iPad mini 5th gen and later)",
       "macOS Sequoia before 15.4.1",
@@ -176062,7 +176062,7 @@
     "ai_assisted_notes": "No primary source attributes AI assistance to weaponization or exploit development. The UNC6148 campaign deploys the hand-built OVERSTEP ELF user-mode rootkit via established post-exploitation tradecraft (ld.so.preload injection, INITRD repacking); no AI-assisted tooling is referenced by GTIG/Mandiant.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-listed 2025-04-16 (exploitation confirmed). Attributed to UNC6148, a suspected financially-motivated actor active since at least October 2024, with tradecraft overlapping historical Abyss-branded ransomware deployments. UNC6148 chains stolen admin credentials/OTP seeds with CVE-2021-20035 on fully-patched but end-of-life SMA 100 appliances to deploy the OVERSTEP persistent backdoor/user-mode rootkit (GTIG/Mandiant, July 2025).",
-    "affected": "SonicWall SMA100 Appliances — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "SonicWall SMA100 Appliances. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SMA 100 series (models 200, 210, 400, 410, 500v): 9.0.0.10-28sv and earlier",
       "SMA 100 series: 10.2.0.7-34sv and earlier",
@@ -176171,7 +176171,7 @@
     "ai_assisted_notes": "No primary source indicates AI was used to weaponize or develop an exploit for CVE-2024-53150. The in-the-wild exploitation is associated with commercial mobile-forensic extraction tooling (Cellebrite-class) requiring physical USB access to a locked Android device; no AI-assisted exploit development is reported.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-listed 2025-04-09 (exploitation confirmed). Part of the Android USB-driver in-the-wild cluster alongside CVE-2024-53197 and CVE-2024-53104; Google's April 2025 Android Security Bulletin flags it as possibly \"under limited, targeted exploitation.\" Exploitation scenario is physical USB access to extract data from locked smartphones, consistent with mobile-forensic/spyware tooling. CVE-2024-53197 (same cluster) was confirmed by Amnesty International to be exploited by Cellebrite forensic tools against a Serbian activist (Dec 2024); GrapheneOS developers assess CVE-2024-53150 as likely part of the same batch. No public named-APT/ransomware-group attribution for this specific CVE.",
-    "affected": "Linux Kernel — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Linux Kernel. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Linux kernel through 5.4.287 (fixed in 5.4.288)",
       "5.5 through 5.10.231 (fixed in 5.10.232)",
@@ -176283,7 +176283,7 @@
     "ai_assisted_notes": "No AI involvement reported in weaponization. The exploit was developed and packaged by Cellebrite as part of a hand-built USB-device-emulation chain (fake video/audio/HID devices) delivered via its UFED forensic extraction hardware. No primary source attributes any part of the exploit development to an AI system. Source: https://www.amnesty.org/en/wp-content/uploads/2025/03/EUR7091182025ENGLISH.pdf",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild by Cellebrite's UFED/UFED Premium forensic extraction tool. Used by Serbian authorities to unlock and root-access the locked Android phone of a Serbian student activist while in detention (first documented in-wild use ~December 25, 2024; broader campaign against journalists/activists disclosed by Amnesty International Security Lab in February 2025). Part of a multi-stage USB-driver exploit chain alongside CVE-2024-53104 (UVC) and CVE-2024-50302 (HID). Commercial forensic/lawful-intercept vendor abuse against civil society; no ransomware association.",
-    "affected": "Linux Kernel — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Linux Kernel. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Linux kernel 2.6.12 through < 4.19.325 (fixed in 4.19.325)",
       "4.20 through < 5.4.287 (fixed in 5.4.287)",
@@ -176396,7 +176396,7 @@
     "ai_assisted_notes": "No primary source attributes the exploit development or weaponization to any AI system. The exploit was hand-crafted by the Storm-2460/RansomEXX actor and delivered in-memory via the PipeMagic backdoor; Microsoft's and BI.ZONE's technical write-ups describe a manually-developed kernel UAF exploit chain with no mention of AI assistance.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild as a zero-day by Storm-2460 (Microsoft tracking), the actor behind the RansomEXX ransomware family, delivered via the PipeMagic backdoor. Post-compromise privilege-escalation use observed before the April 8, 2025 patch against organizations in US IT and real-estate sectors, the Venezuelan financial sector, a Spanish software company, and the Saudi retail sector. CISA KEV-listed 2025-04-08 with known_ransomware = Known.",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Windows Server 2008 R2 SP1 / 2012 / 2012 R2 / 2016 / 2019 / 2022 / 2022 23H2 / 2025 (x64) — fixed via April 2025 Patch Tuesday updates",
       "Windows 10 (1607, 1809, 21H2, 22H2; 32-bit and x64) — vulnerable; fix released April 2025 (Windows 10 packages initially delayed at disclosure, then shipped)",
@@ -176505,7 +176505,7 @@
     "ai_assisted_notes": "No primary source credits any AI system with weaponization. The exploitation technique is the well-established public ASP.NET ViewState deserialization attack (ysoserial.net-style gadget chains) applied to a leaked/hard-coded machineKey; Huntress researchers hand-developed proof-of-concept exploits. No AI-assisted exploit development is reported.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2025-04-08, due 2025-04-29). Exploited in the wild since March 2025 per NVD/vendor; Huntress observed the earliest indicator of compromise in its partner base at 2025-04-11 16:59:44 UTC and documented seven compromised organizations (~120 endpoints running the software identified). No public named threat-actor/ransomware attribution. Observed post-exploitation tooling: out-of-band (oastify.com) connectivity tests via PowerShell, Cobalt Strike loaded via a sideloaded d3d11.dll (with a renamed Wallpaper Engine launcher \"Centre.exe\"), and MeshCentral for persistent remote access plus lateral movement.",
-    "affected": "Gladinet CentreStack — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Gladinet CentreStack. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Gladinet CentreStack through 16.1.10296.56315 (all versions below the fixed 16.4.10315.56368)",
       "Gladinet Triofox: all versions below 16.4.10317.56372"
@@ -176613,7 +176613,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted weaponization. The public PoC (GitHub iSee857, published 2025-03-13) and the in-the-wild exploitation first observed 2025-03-12 (Wallarm, detected in Poland) are attributed to conventional human researchers/operators. Wallarm and Zscaler ThreatLabz reporting describes manually crafted partial-PUT exploit chains with no AI tooling named.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2025-04-01, due 2025-04-22). No public threat-actor or ransomware-group attribution (CISA known_ransomware: Unknown). First in-the-wild exploitation attempt observed 2025-03-12 by Wallarm (detected in Poland), only ~2 days after the 2025-03-10 disclosure and before any public PoC existed; opportunistic mass-scanning/exploitation followed the 2025-03-13 public PoC (GitHub iSee857). Reported by Zscaler ThreatLabz, Wallarm, SonicWall, and Akamai as broadly exploited against internet-facing Tomcat.",
-    "affected": "Apache Tomcat — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Apache Tomcat. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Apache Tomcat 11.0.0-M1 through 11.0.2 (fixed in 11.0.3)",
       "Apache Tomcat 10.1.0-M1 through 10.1.34 (fixed in 10.1.35)",
@@ -176725,7 +176725,7 @@
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. The static backdoor credential (cslu-windows-client:Library4C$LU) was recovered and published by human researcher Nicholas Starke via manual reverse engineering shortly after the September 2024 advisory; in-the-wild exploitation followed that public disclosure. No primary source attributes weaponization to any named AI system. Sources: https://isc.sans.edu/diary/31782 ; https://www.helpnetsecurity.com/2025/04/03/attackers-are-leveraging-cisco-smart-licensing-utility-static-admin-credentials-cve-2024-20439/",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2025-03-31). Cisco PSIRT became aware of attempted exploitation in the wild in March 2025; exploitation followed Nicholas Starke's September 2024 blog publishing the static credential. Johannes Ullrich / SANS ISC observed mass exploit attempts hitting the /cslu/v1 API with the hardcoded Basic-auth credentials, often chained with CVE-2024-20440 (info-disclosure log read). No specific named ransomware group or APT publicly attributed; KEV \"known_ransomware\" = Unknown.",
-    "affected": "Cisco Smart Licensing Utility — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Cisco Smart Licensing Utility. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Cisco Smart Licensing Utility (CSLU) 2.0.0",
       "Cisco Smart Licensing Utility (CSLU) 2.1.0",
@@ -176834,7 +176834,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development or weaponization. The exploit was attributed to the ForumTroll APT / Memento Labs (ex-Hacking Team) spyware tooling (Dante), with no mention of any named AI system in the build chain.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild as a zero-day since March 2025 in \"Operation ForumTroll\" by the ForumTroll APT (tracked by Kaspersky as Mem3nt0 mori), delivering the Dante commercial spyware developed by Memento Labs (formerly Hacking Team). Delivery was no-click spear-phishing with short-lived personalized links (Primakov Readings forum lure) targeting Russian media, government, education and diplomatic entities. A second actor, TaxOff, was separately reported exploiting it to deploy the Trinper backdoor. Reported to Google 2025-03-20; KEV-listed 2025-03-27.",
-    "affected": "Google Chromium Mojo — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Google Chromium Mojo. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Google Chrome on Windows prior to 134.0.6998.177",
       "Chromium-based browsers using the affected Mojo IPC (e.g. Microsoft Edge, Opera) on Windows prior to their corresponding 134.0.6998.177-equivalent fix"
@@ -176940,7 +176940,7 @@
     "ai_assisted_notes": "The public PoC was hand-built by Synacktiv using the open-source ysoserial.net gadget generator (TypeConfuseDelegate / ObjectStateFormatter formatter). No AI system is credited with weaponization in any primary or secondary source.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2019-9874 and 2019-9875 together on 2025-03-26, due 2025-04-16); no public threat-actor attribution. Notably the vendor (Sitecore) and reporting confirm active exploitation specifically of the UNAUTHENTICATED sibling CVE-2019-9874; CVE-2019-9875 (the authenticated variant) was KEV-listed alongside it but has no separately documented in-the-wild campaign or actor.",
-    "affected": "Sitecore CMS and Experience Platform (XP) — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Sitecore CMS and Experience Platform (XP). The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sitecore Experience Platform (XP) 9.x prior to 9.1.1 (9.1 Update-1) — authenticated exploitation (this CVE)",
       "NVD scope: Sitecore through 9.1 (anti-CSRF module, authenticated)",
@@ -177047,7 +177047,7 @@
     "ai_assisted_notes": "No source indicates AI/LLM assistance in building the exploit. Weaponization is a standard .NET deserialization gadget chain (ysoserial.net-style) injected via the __CSRFTOKEN POST parameter; Synacktiv published a manually written proof-of-concept. No AI tooling credited.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA KEV 2025-03-26); no public actor attribution. CISA KEV lists known_ransomware as \"Unknown\". Sitecore stated it became aware of active exploitation in an advisory update dated 2020-03-30; CISA's KEV addition in March 2025 cites evidence of active exploitation but names no threat actor, ransomware group, or campaign. Synacktiv published a public PoC.",
-    "affected": "Sitecore CMS and Experience Platform (XP) — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Sitecore CMS and Experience Platform (XP). The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Sitecore CMS 7.0 through 7.2",
       "Sitecore XP (Experience Platform) 7.5 through 8.2",
@@ -177154,7 +177154,7 @@
     "ai_assisted_notes": "No source credits AI-assisted exploit development. Public PoCs (e.g. abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal on GitHub) are hand-written directory-traversal scanners; exploitation uses a simple `..` query-string payload plus publicly available SAP Secure Store credential-decryption tools, with no AI tooling described.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2025-03-19, due 2025-04-09). Per NVD, originally exploited in the wild in August 2017 (SAP Security Note 2486657). Onapsis Research Labs reported renewed active exploitation in 2025 via its global SAP Threat Intelligence Network; attackers demonstrate deep SAP knowledge, exfiltrating SAP system files (including the SAP Secure Store binary) to decrypt stored credentials and pivot into full SAP-application compromise. No public named threat-actor/ransomware/campaign attribution.",
-    "affected": "SAP NetWeaver — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "SAP NetWeaver. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "SAP NetWeaver Application Server (AS) Java 7.5",
       "Component ENGINEAPI 7.50 SP02 through SP05",
@@ -177262,7 +177262,7 @@
     "ai_assisted_notes": "watchTowr's public PoC (https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/) was hand-built from decompiled-Java analysis of the /c/router dispatcher and STPreLoadManagement action; no AI tool/agent is credited with building or accelerating the exploit in any primary source.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-19, due 2025-04-09). Exploitation is opportunistic/mass and unattributed at the time of KEV listing — no named threat actor, ransomware group, or campaign tied to it in public reporting; security press (Help Net Security, BleepingComputer) noted exploitation against unpatched internet-facing instances after watchTowr's 2025-02-26 public disclosure + PoC release, with no confirmed ransomware attribution.",
-    "affected": "NAKIVO Backup and Replication — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "NAKIVO Backup and Replication. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "NAKIVO Backup & Replication before 11.0.0.88174 (all versions prior, including 10.11.3.86570 and earlier)",
       "Fixed in 11.0.0.88174 (silently patched 2024-11-04)"
@@ -177369,7 +177369,7 @@
     "ai_assisted_notes": "No evidence of AI-assisted exploit development. Weaponization is conventional commodity-botnet tooling: Mirai-variant droppers injected via a CGI parameter, fetching multi-architecture (x86/ARM/MIPS) ELF payloads through curl/wget shell scripts. No primary source attributes the exploit or loader to an AI system.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-19). Exploited in the wild by at least two Mirai-variant botnets: a strain Akamai labels \"Unstable Mirai\" beaconing to angela.spklove.com:3093 (string \"VagneRHere\"), and a second anti-debugging variant (\"Hello, World!\") using merisprivate.net / ziparchive.xyz C2 infrastructure. Akamai SIRT honeypots logged earliest activity in May 2024 (some reporting cites October 2024 campaign detection), with a public PoC available since June 2023. No nation-state actor attributed; activity is financially/DDoS-motivated commodity botnet operators. No known ransomware association.",
-    "affected": "Edimax IC-7100 IP Camera — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Edimax IC-7100 IP Camera. The affected builds are in CISA ICS advisory ICSA-25-063-08, which this entry links to.",
     "affected_versions": [
       "Edimax IC-7100 IP camera — all firmware versions (no fixed version exists; product is end-of-life / end-of-service and will not receive a security patch)"
     ],
@@ -177449,7 +177449,7 @@
         "Beaconing to known Mirai C2 such as angela.spklove.com:3093 (193.143.1.118) or merisprivate.net / ziparchive.xyz / virtuehub.one domains",
         "Presence of Mirai-variant marker strings in process memory or dropped binaries (\"VagneRHere\", \"Hello, World!\") and outbound TCP/UDP DDoS flood traffic from the camera"
       ],
-      "_ioc_source_note": "Anchored to NVD CVE-2025-1316, CISA KEV (added 2025-03-19), and the Edimax advisory recorded in vendor_advisories."
+      "_ioc_source_note": "Anchored to NVD CVE-2025-1316, CISA KEV (added 2025-03-19), and CISA ICS advisory ICSA-25-063-08."
     },
     "_auto_imported": false,
     "_intake_method": "manual-verified-curation",
@@ -177477,7 +177477,7 @@
     "ai_assisted_notes": "No primary source attributes AI tooling to exploit development or weaponization. The SuperBlack toolchain (Forescout-attributed) consists of conventional custom scripts, a LockBit 3.0-derived encryptor, and a custom wiper; no AI-assisted exploit-generation is reported.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild by the financially-motivated ransomware operator tracked as \"Mora_001\" (LockBit-linked; LockBit 3.0 builder leak lineage) deploying the \"SuperBlack\" ransomware (a rebranded/modified LockBit 3.0 strain). Forescout Research observed the campaign between late January and early March 2025, chaining CVE-2025-24472 with the sibling auth-bypass CVE-2024-55591 against internet-exposed FortiGate firewalls. CISA added CVE-2025-24472 to KEV on 2025-03-18 (due 2025-04-08); the KEV record flags known_ransomware = \"Known\".",
-    "affected": "Fortinet FortiOS and FortiProxy — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Fortinet FortiOS and FortiProxy. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "FortiOS 7.0.0 through 7.0.16 (fixed in 7.0.17 and above)",
       "FortiProxy 7.2.0 through 7.2.12 (fixed in 7.2.13 and above)",
@@ -177587,7 +177587,7 @@
     "ai_assisted_notes": "No primary source indicates AI-assisted exploit development. UNC3886 hand-built the process-injection chain (loader.bin/pc.bin/payload.bin, /proc/pid/mem writes, GOT overwrite of fclose) to bypass Junos Veriexec and load TINYSHELL-based PIC backdoors. No AI tooling is referenced in Mandiant's analysis. Source: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild by UNC3886, a China-nexus cyber-espionage group targeting defense, technology, and telecom organizations in the US and Asia. Mandiant first observed the activity in mid-2024 (custom backdoors deployed on end-of-life Juniper MX routers). KEV-listed 2025-03-13 with a 2025-04-03 federal remediation due date. No ransomware association (\"Known ransomware: Unknown\").",
-    "affected": "Juniper Junos OS — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Juniper Junos OS. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Junos OS: all versions before 21.2R3-S9",
       "21.4 before 21.4R3-S10",
@@ -177701,7 +177701,7 @@
     "ai_assisted_notes": "No primary source describes AI-assisted exploit development or weaponization for CVE-2025-24993. Public reporting describes a conventional VHD-mount trigger; no AI tooling is referenced in any exploitation account.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed exploited as a zero-day prior to the 2025-03-11 patch (added to CISA KEV 2025-03-11, due 2025-04-01); no public threat-actor attribution for the NTFS RCE specifically. The CVE was disclosed in the same March 2025 Patch Tuesday cluster as CVE-2025-24983, which ESET tied to the PipeMagic backdoor, but that attribution is for the Win32k LPE, not this NTFS heap overflow. CISA KEV marks known_ransomware = Unknown for this entry.",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Windows 10 Version 1507 (RTM) - all 32-bit/x64 builds prior to the March 2025 update",
       "Windows 10 Version 1607, 1809, 21H2, 22H2",
@@ -177814,7 +177814,7 @@
     "ai_assisted_notes": "No primary source attributes the in-the-wild exploit code or its weaponization to any AI tool or AI-assisted workflow. Exploitation is described as crafting a malicious VHD/VHDX and socially engineering a user into mounting it; no AI-generation claim is made by Microsoft, ESET, Trend Micro, or ZDI.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-11, due 2025-04-01); exploited as a zero-day in limited, targeted attacks before the March 2025 Patch Tuesday fix. One of six Windows file-system zero-days patched together; reported as chained for info-disclosure with CVE-2025-24984 and adjacent to the RCE chain CVE-2025-24985/CVE-2025-24993. No public threat-actor attribution is tied specifically to CVE-2025-24991 (the named actors attach to sibling CVEs — PipeMagic/RansomEXX on CVE-2025-24983 and EncryptHub/LARVA-208 on CVE-2025-26633). CISA KEV lists known-ransomware-use as Unknown for this CVE. KEV-confirmed; no public actor attribution specific to this CVE.",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Windows 10 Version 1507 (RTM)",
       "Windows 10 Version 1607",
@@ -177931,7 +177931,7 @@
     "ai_assisted_notes": "No primary source describes any AI tool or agent being used to weaponize or develop an exploit for CVE-2025-24985. Exploitation was observed in the wild as a zero-day; the delivery technique (malicious VHD mounted by a tricked local user) is conventional and pre-dates this CVE. No AI involvement reported.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (added 2025-03-11, due 2025-04-01); exploited in the wild as a zero-day at the time of the March 2025 Patch Tuesday disclosure. No public threat-actor/campaign attribution and CISA lists known-ransomware use as \"Unknown.\" Observed delivery for this VHD-mount class historically uses phishing lures and pirated-software/cracked-app sites; first-in-wild date not publicly pinned beyond pre-2025-03-11.",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Windows 10 Version 1507 (all editions)",
       "Windows 10 Version 1607 / Windows Server 2016",
@@ -178045,7 +178045,7 @@
     "ai_assisted_notes": "No primary source attributes the discovery, PoC, or any in-the-wild exploitation tooling for CVE-2025-24984 to an AI system. KEV-confirmed exploitation carries no public actor attribution and no public weaponization narrative.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "KEV-confirmed (CISA added 2025-03-11, due 2025-04-01); no public actor attribution. Physical-access information disclosure shipped alongside CVE-2025-24993 (NTFS heap overflow, RCE) and CVE-2025-24985 (Fast FAT) in the same March 2025 Patch Tuesday cluster of six exploited zero-days, where the practical chain is a malicious crafted VHD/USB image mounted by the victim. Microsoft marked it exploited; no ransomware association recorded in KEV. Some trackers (Tenable) annotate exploitation activity predating disclosure, but no named campaign or threat group is publicly tied to this specific CVE.",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Windows 10 Version 1507 / 1607 / 1809 / 21H2 / 22H2 (x86, x64, ARM64 as applicable)",
       "Windows 11 Version 22H2 / 23H2 / 24H2 (x64, ARM64)",
@@ -178156,7 +178156,7 @@
     "ai_assisted_notes": "No primary source credits an AI system with weaponizing or developing the exploit. The exploit was crafted and operated by the Storm-2460 threat cluster and delivered via the PipeMagic backdoor; the only AI tie-in is thematic social-engineering (PipeMagic later masqueraded as an open-source ChatGPT desktop app), which is lure branding, not AI-assisted exploit development.",
     "active_exploitation": "confirmed",
     "active_exploitation_notes": "Exploited in the wild as a zero-day since approximately March 2023 (roughly two years before the March 2025 patch). ESET attributes deployment to the PipeMagic modular backdoor; Microsoft tracks the operator as Storm-2460, which chained PipeMagic into post-compromise privilege escalation and (via the companion CLFS zero-day CVE-2025-29824) RansomEXX-family ransomware. Targets spanned IT/real-estate (US), financial (Venezuela), a Spanish software firm, and retail (Saudi Arabia). KEV-listed 2025-03-11. Note: CISA KEV marks this specific CVE known_ransomware=\"Unknown\" (the ransomware payload chain ran through the CLFS bug, not this Win32k EoP).",
-    "affected": "Microsoft Windows — see vendor advisory in verification_sources for exact affected/fixed builds.",
+    "affected": "Microsoft Windows. The exact affected and fixed builds are in the vendor advisory this entry links to.",
     "affected_versions": [
       "Windows 8.1 (x64/x86) and Windows Server 2012 R2 — primary in-the-wild exploitation targets",
       "Windows Server 2016 (still-supported, vulnerable)",
@@ -180012,7 +180012,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by Stefan Schiller of Sonar (SonarSource) through manual and static code review of Cacti's remote_agent.php authorization logic, reported to the project on 2022-12-02, with the vendor confirming and patching the same day; published as GHSA-6p93-p743-35gf and in Sonar's writeup 'Cacti: Unauthenticated Remote Code Execution'. Sonar records an independent discovery by Steven Seeley via ZDI on 2022-11-25. No AI system is credited in the GitHub advisory, the Sonar research, or NVD.",
     "ai_assisted_weaponization": false,
-    "affected": "Cacti Cacti",
+    "affected": "Cacti",
     "affected_versions": [
       "Cacti through 1.2.22 (all 1.2.x releases at or below 1.2.22)",
       "Fixed in Cacti 1.2.23 (commit 7f0e163) and 1.3.0 (commit b43f13a); PHP < 7.0 installs additionally need commit a8d59e8",
@@ -180649,7 +180649,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered and published on 2022-03-07 by researchers at Octagon Networks (the blog now resolves to pwn.ai), who manually reverse-engineered TOS's api.php dynamic class-instantiation logic and the $notCheck / $notHeader static allowlists in mobile.class.php to find methods reachable without authentication, then traced createRaid's raidtype parameter to an unsanitised popen() call. No AI tooling is credited in the writeup, in the Metasploit module, or in the Nuclei template, and the work is classic manual PHP source review of extracted firmware.",
     "ai_assisted_weaponization": false,
-    "affected": "TerraMaster TerraMaster OS",
+    "affected": "TerraMaster OS",
     "affected_versions": [
       "TerraMaster TOS <= 4.2.29 (all TerraMaster NAS models running the affected firmware; the Metasploit module is validated against TOS 4.2.08 on F2-221 x86_64)",
       "Fixed in TerraMaster TOS 4.2.30; TerraMaster subsequently shipped 4.2.31"
@@ -187294,7 +187294,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Attributed to Sebastian Krahmer (c-skills / 'The Android Exploid Crew'), who published the GingerBreak analysis and source on 2011-04-21; xorl published an independent root-cause analysis of the mPartMinors signedness issue on 2011-04-28. Google's mitigating AOSP commit in platform/system/vold (c51920c82463b240e2be0430849837d6fdc5352e, Nick Kralevich) is dated 2011-04-18, so AOSP was hardening the netlink path in the same week the exploit went public; the public record does not settle which came first. Either way this is a hand-audited signedness defect in a 2011 C++ daemon with no AI tooling in the discovery path.",
     "ai_assisted_weaponization": false,
-    "affected": "Android Android OS",
+    "affected": "Android OS",
     "affected_versions": [
       "Android 2.x before 2.3.4",
       "Android 3.0 (Honeycomb)",
@@ -187391,7 +187391,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Found by Hussein Daher and Shubham Shah of the Assetnote security research team through whitebox source auditing of dotCMS during a bank engagement, then coordinated with the vendor: reported 2022-02-21, vendor response 2022-03-02, status and fix details exchanged 2022-03-31, publication announced 2022-04-26 with the full writeup on 2022-05-03. No AI tooling was credited — this was manual source review of the ContentResource upload path.",
     "ai_assisted_weaponization": false,
-    "affected": "dotCMS dotCMS",
+    "affected": "dotCMS",
     "affected_versions": [
       "dotCMS 3.0 through 22.02",
       "Fixed in dotCMS 22.03",
@@ -187789,7 +187789,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Found by Jan Vojtesek of Avast Threat Intelligence, not through code auditing but by analysing a live attack: Avast caught the exploit being served to its own users in the Middle East and reported it to Google as crbug 1341043, which shipped as Chrome 103.0.5060.114 on 2022-07-04. Google Project Zero credits Vojtesek as reporter in its root-cause analysis, and Avast published the campaign as 'The Return of Candiru: Zero-days in the Middle East'. Recorded as human_researcher because the catalog's provenance enum reserves its remaining values for AI-assisted discovery, but the operative fact is that this was incident-response discovery of an already-deployed zero-day, not proactive research and not AI-assisted fuzzing.",
     "ai_assisted_weaponization": false,
-    "affected": "WebRTC WebRTC",
+    "affected": "WebRTC",
     "affected_versions": [
       "Google Chrome < 103.0.5060.114 (and Chromium-based browsers rebased below it)",
       "WebKitGTK < 2.36.5 and WPE WebKit < 2.36.5",