@blamejs/exceptd-skills 0.9.1

package/data/exploit-availability.json

@@ -0,0 +1,67 @@
+{
+  "_meta": {
+    "schema_version": "1.0.0",
+    "last_updated": "2026-05-01",
+    "note": "Tracks PoC availability and weaponization stage per CVE. Update when status changes. last_verified must be within 90 days.",
+    "tlp": "CLEAR",
+    "source_confidence": {
+      "scheme": "Admiralty (A-F + 1-6)",
+      "default": "B2",
+      "note": "B = usually reliable; 2 = probably true. Per-entry overrides via entry-level source_confidence field. Public-record catalogs (NVD, ATLAS, CWE, RFC, framework publishers) get A1 (completely reliable, confirmed). Project-curated catalogs (zeroday-lessons, exploit-availability) default to B2 with source citations."
+    },
+    "freshness_policy": {
+      "default_review_cadence_days": 90,
+      "stale_after_days": 180,
+      "rebuild_after_days": 365,
+      "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
+    }
+  },
+  "CVE-2026-31431": {
+    "poc_status": "public",
+    "poc_description": "Single-stage deterministic root escalation script, reported as 732 bytes. No race condition. Requires unprivileged local code execution.",
+    "weaponization_stage": "fully_weaponized",
+    "ai_discovery_confirmed": true,
+    "ai_discovery_notes": "Researcher reports AI system discovery in approximately 1 hour via automated vulnerability analysis",
+    "metasploit_module": "unknown",
+    "exploit_complexity": "low",
+    "last_verified": "2026-05-01",
+    "verification_source": "NVD references, CISA KEV listing, researcher disclosures"
+  },
+  "CVE-2026-43284": {
+    "poc_status": "public",
+    "poc_description": "Chain component — exploits ESP/IPsec subsystem. Requires combination with CVE-2026-43500 or independent gadget chain.",
+    "weaponization_stage": "partially_weaponized",
+    "ai_discovery_confirmed": false,
+    "exploit_complexity": "moderate",
+    "last_verified": "2026-05-01",
+    "verification_source": "NVD references, researcher (Hyunwoo Kim) disclosure"
+  },
+  "CVE-2026-43500": {
+    "poc_status": "public",
+    "poc_description": "Chain component — RxRPC subsystem. Used with CVE-2026-43284.",
+    "weaponization_stage": "partially_weaponized",
+    "ai_discovery_confirmed": false,
+    "exploit_complexity": "moderate",
+    "last_verified": "2026-05-01",
+    "verification_source": "NVD references, researcher (Hyunwoo Kim) disclosure"
+  },
+  "CVE-2025-53773": {
+    "poc_status": "demonstrated",
+    "poc_description": "Demonstrated in controlled environment — adversarial instructions in PR description field trigger code execution via GitHub Copilot interaction.",
+    "weaponization_stage": "demonstrated",
+    "ai_discovery_confirmed": false,
+    "ai_tool_enabled": true,
+    "exploit_complexity": "low",
+    "last_verified": "2026-05-01",
+    "verification_source": "NVD, GitHub Security Advisory"
+  },
+  "CVE-2026-30615": {
+    "poc_status": "partial",
+    "poc_description": "Conceptual exploit demonstrated — malicious MCP server → zero-interaction RCE via AI client vulnerability in Windsurf.",
+    "weaponization_stage": "partial",
+    "ai_discovery_confirmed": false,
+    "exploit_complexity": "low_once_mcp_server_installed",
+    "last_verified": "2026-05-01",
+    "verification_source": "NVD, Windsurf vendor advisory"
+  }
+}