[ { "trajectory_id": "TRAJ-CVE-2020-2021", "entity_id": "CVE-2020-2021", "title": "Palo Alto Networks PAN-OS SAML Subsystem Palo Alto Networks PAN-OS SAML Authentication Bypass", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 99, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 99, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2020-01-15T00:00:00.000Z", "event_date": "2020-01-15", "threat_score": 99, "observation_id": "OBS-2020-000001", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 99, "observation_id": "OBS-2026-000002", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2020-3452", "entity_id": "CVE-2020-3452", "title": "Cisco Systems Cisco Adaptive Security Appliance (ASA) Web Services Cisco ASA and FTD Web Services Read-Only Path Traversal", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2020-01-15T00:00:00.000Z", "event_date": "2020-01-15", "threat_score": 92, "observation_id": "OBS-2020-000003", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 92, "observation_id": "OBS-2026-000004", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2022-42475", "entity_id": "CVE-2022-42475", "title": "Fortinet FortiOS SSL-VPN Daemon Fortinet FortiOS SSL-VPN Pre-Auth Heap Buffer Overflow", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2022-01-15T00:00:00.000Z", "event_date": "2022-01-15", "threat_score": 97, "observation_id": "OBS-2022-000005", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 97, "observation_id": "OBS-2026-000006", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2023-20198", "entity_id": "CVE-2023-20198", "title": "Cisco Systems Cisco IOS XE Web UI Subsystem Cisco IOS XE Software Web UI Privilege Escalation Zero-Day", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 100, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 100, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2023-01-15T00:00:00.000Z", "event_date": "2023-01-15", "threat_score": 100, "observation_id": "OBS-2023-000007", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 100, "observation_id": "OBS-2026-000008", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2023-27997", "entity_id": "CVE-2023-27997", "title": "Fortinet FortiOS SSL-VPN Service Fortinet FortiOS SSL-VPN Heap Buffer Overflow RCE (Volt Typhoon)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 99, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 99, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2023-01-15T00:00:00.000Z", "event_date": "2023-01-15", "threat_score": 99, "observation_id": "OBS-2023-000009", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 99, "observation_id": "OBS-2026-000010", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2024-0012", "entity_id": "CVE-2024-0012", "title": "Palo Alto Networks PAN-OS Management Interface Palo Alto Networks PAN-OS Management Web Interface Authentication Bypass", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2024-01-15T00:00:00.000Z", "event_date": "2024-01-15", "threat_score": 98, "observation_id": "OBS-2024-000011", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 98, "observation_id": "OBS-2026-000012", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2024-20353", "entity_id": "CVE-2024-20353", "title": "Cisco Systems Cisco Adaptive Security Appliance (ASA) & Firepower Threat Defense (FTD) Cisco ASA and FTD Web Server Denial of Service & Memory Corruption (ArcaneDoor)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2024-01-15T00:00:00.000Z", "event_date": "2024-01-15", "threat_score": 96, "observation_id": "OBS-2024-000013", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 96, "observation_id": "OBS-2026-000014", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2024-20359", "entity_id": "CVE-2024-20359", "title": "Cisco Systems Cisco Adaptive Security Appliance (ASA) Core OS Cisco ASA and FTD Persistent Local Code Execution (Line Runner / ArcaneDoor)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2024-01-15T00:00:00.000Z", "event_date": "2024-01-15", "threat_score": 94, "observation_id": "OBS-2024-000015", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 94, "observation_id": "OBS-2026-000016", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2024-21762", "entity_id": "CVE-2024-21762", "title": "Fortinet FortiOS SSL-VPN Gateway Fortinet FortiOS SSL-VPN Out-of-Bounds Write Remote Code Execution Zero-Day", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 100, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 100, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2024-01-15T00:00:00.000Z", "event_date": "2024-01-15", "threat_score": 100, "observation_id": "OBS-2024-000017", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 100, "observation_id": "OBS-2026-000018", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2024-3400", "entity_id": "CVE-2024-3400", "title": "Palo Alto Networks PAN-OS GlobalProtect Palo Alto Networks PAN-OS GlobalProtect Command Injection Zero-Day", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 100, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 100, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2024-01-15T00:00:00.000Z", "event_date": "2024-01-15", "threat_score": 100, "observation_id": "OBS-2024-000019", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 100, "observation_id": "OBS-2026-000020", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2024-47575", "entity_id": "CVE-2024-47575", "title": "Fortinet FortiManager Central Management Console Fortinet FortiManager fgfmd Authentication Bypass & Remote Code Execution (FortiJump)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 100, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 100, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2024-01-15T00:00:00.000Z", "event_date": "2024-01-15", "threat_score": 100, "observation_id": "OBS-2024-000021", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 100, "observation_id": "OBS-2026-000022", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-26319", "entity_id": "CVE-2025-26319", "title": "Flowise Arbitrary File Upload and Directory Traversal Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2025-02-18T00:00:00.000Z", "event_date": "2025-02-18", "threat_score": 96, "observation_id": "OBS-2025-000025", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 96, "observation_id": "OBS-2026-000026", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-3248", "entity_id": "CVE-2025-3248", "title": "Langflow Unauthenticated Code Validation Python exec() Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2025-04-12T00:00:00.000Z", "event_date": "2025-04-12", "threat_score": 97, "observation_id": "OBS-2025-000027", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 97, "observation_id": "OBS-2026-000028", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-54794", "entity_id": "CVE-2025-54794", "title": "Claude Code Working Directory Sandbox Escape via Path Prefix Matching", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 84, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 84, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2025-07-15T00:00:00.000Z", "event_date": "2025-07-15", "threat_score": 84, "observation_id": "OBS-2025-000031", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 84, "observation_id": "OBS-2026-000032", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-54795", "entity_id": "CVE-2025-54795", "title": "Claude Code Echo Command Injection and Approval Prompt Bypass via Untrusted Context", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2025-07-22T00:00:00.000Z", "event_date": "2025-07-22", "threat_score": 92, "observation_id": "OBS-2025-000033", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 92, "observation_id": "OBS-2026-000034", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-59528", "entity_id": "CVE-2025-59528", "title": "Flowise CustomMCP Node JavaScript Function Constructor Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 99, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 99, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2025-08-04T00:00:00.000Z", "event_date": "2025-08-04", "threat_score": 99, "observation_id": "OBS-2025-000035", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 99, "observation_id": "OBS-2026-000036", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-39964", "entity_id": "CVE-2025-39964", "title": "Linux Kernel Crypto AF_ALG Concurrent Write Race Condition", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 48, "net_change": 43, "observation_count": 4, "current_acceleration_rate": 3, "inflection_point": "accelerating", "inflection_rationale": "Trajectory operating under accelerating regime with velocity 3 pts/day." }, "curve": [ { "timestamp": "2025-08-10T00:00:00.000Z", "event_date": "2025-08-10", "threat_score": 48, "observation_id": "OBS-2025-000246", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial upstream commit submitted to kernel crypto subsystem." }, { "timestamp": "2025-09-02T00:00:00.000Z", "event_date": "2025-09-02", "threat_score": 62, "observation_id": "OBS-2025-000247", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Public advisory published; theoretical local DoS rated CVSS 5.5." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 88, "observation_id": "OBS-2026-000248", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "CISA adds to KEV catalog citing active exploitation in the wild." }, { "timestamp": "2026-09-19T00:00:00.000Z", "event_date": "2026-09-19", "threat_score": 91, "observation_id": "OBS-2026-000249", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Public functional LPE exploit repository published by n1k0oowang." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-39682", "entity_id": "CVE-2025-39682", "title": "Linux Kernel kTLS Receive Path Zero-Length Record Use-After-Free Local Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 65, "net_change": 29, "observation_count": 3, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2025-08-20T00:00:00.000Z", "event_date": "2025-08-20", "threat_score": 65, "observation_id": "OBS-2025-000029", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial disclosure in net/tls/tls_sw.c; vendor patches issued." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 94, "observation_id": "OBS-2026-000251", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "CISA adds to KEV catalog with mandatory BOD 22-01 remediation deadline." }, { "timestamp": "2026-09-19T00:00:00.000Z", "event_date": "2026-09-19", "threat_score": 94, "observation_id": "OBS-2026-000030", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Hermes confirms weaponized exploitation across enterprise Linux fleets." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2025-25249", "entity_id": "CVE-2025-25249", "title": "Fortinet FortiOS, FortiSwitchManager & FortiSASE cw_acd CAPWAP Heap Buffer Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-01-13T00:00:00.000Z", "event_date": "2026-01-13", "threat_score": 98, "observation_id": "OBS-2026-000023", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-09T00:00:00.000Z", "event_date": "2026-09-09", "threat_score": 98, "observation_id": "OBS-2026-000024", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-22778", "entity_id": "CVE-2026-22778", "title": "vLLM Multimodal Processing Chained Memory Leak and JPEG2000 Heap Overflow Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 4, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-02-02T00:00:00.000Z", "event_date": "2026-02-02", "threat_score": 97, "observation_id": "OBS-2026-000053", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 72, "observation_id": "OBS-2026-000253", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Disclosed as internal memory anomaly in video parsing stack." }, { "timestamp": "2026-09-19T00:00:00.000Z", "event_date": "2026-09-19", "threat_score": 97, "observation_id": "OBS-2026-000054", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Chained heap overflow exploit weaponized; remote shell on inference nodes." }, { "timestamp": "2026-09-20T00:00:00.000Z", "event_date": "2026-09-20", "threat_score": 97, "observation_id": "OBS-2026-000255", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Hermes Decision Engine issues mandatory ISOLATE & PATCH directive." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-27825", "entity_id": "CVE-2026-27825", "title": "mcp-atlassian Confluence Download Attachment Arbitrary File Write RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-02-18T00:00:00.000Z", "event_date": "2026-02-18T00:00:00.000Z", "threat_score": 91, "observation_id": "OBS-2026-000057", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-27826", "entity_id": "CVE-2026-27826", "title": "mcp-atlassian Unvalidated Header SSRF to Cloud Instance Metadata", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 82, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 82, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-02-18T00:00:00.000Z", "event_date": "2026-02-18T00:00:00.000Z", "threat_score": 82, "observation_id": "OBS-2026-000058", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-4372", "entity_id": "CVE-2026-4372", "title": "Hugging Face Transformers Configuration Injection RCE via Attention Implementation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-03-04T00:00:00.000Z", "event_date": "2026-03-04", "threat_score": 97, "observation_id": "OBS-2026-000083", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 97, "observation_id": "OBS-2026-000084", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-78234", "entity_id": "CVE-2026-78234", "title": "Hawtio Operator OpenShift Service CA Signing Key Theft and Cluster Identity Impersonation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 95, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 95, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-03-05T00:00:00.000Z", "event_date": "2026-03-05", "threat_score": 95, "observation_id": "OBS-2026-000168", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-21T00:00:00.000Z", "event_date": "2026-09-21", "threat_score": 95, "observation_id": "OBS-2026-000169", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-86711", "entity_id": "CVE-2026-86711", "title": "Electerm Desktop runGlobalAsync Electron IPC Handler Arbitrary Command Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-03-10T00:00:00.000Z", "event_date": "2026-03-10", "threat_score": 88, "observation_id": "OBS-2026-000203", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-21T00:00:00.000Z", "event_date": "2026-09-21", "threat_score": 88, "observation_id": "OBS-2026-000204", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-70477", "entity_id": "CVE-2026-70477", "title": "Flowise AI CSV Agent Node Prompt Injection to Unsandboxed Pyodide Host Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-03-12T00:00:00.000Z", "event_date": "2026-03-12", "threat_score": 96, "observation_id": "OBS-2026-000147", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-21T00:00:00.000Z", "event_date": "2026-09-21", "threat_score": 96, "observation_id": "OBS-2026-000148", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-20079", "entity_id": "CVE-2026-20079", "title": "Cisco Secure Firewall Management Center Authentication Bypass to Root RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "active" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-03-25T00:00:00.000Z", "event_date": "2026-03-25", "threat_score": 98, "observation_id": "OBS-2026-000043", "cisa_kev": true, "exploit_maturity": "active", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-09T00:00:00.000Z", "event_date": "2026-09-09", "threat_score": 98, "observation_id": "OBS-2026-000044", "cisa_kev": true, "exploit_maturity": "active", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-32626", "entity_id": "CVE-2026-32626", "title": "AnythingLLM Desktop Streaming Phase Markdown-it XSS to Electron Host Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 95, "net_change": -7, "observation_count": 4, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-04-10T00:00:00.000Z", "event_date": "2026-04-10", "threat_score": 95, "observation_id": "OBS-2026-000063", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-17T00:00:00.000Z", "event_date": "2026-09-17", "threat_score": 60, "observation_id": "OBS-2026-000256", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Unescaped image alt tag in markdown renderer discovered." }, { "timestamp": "2026-09-19T00:00:00.000Z", "event_date": "2026-09-19", "threat_score": 88, "observation_id": "OBS-2026-000064", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Demonstrated Electron IPC escape via RAG document indirect prompt injection." }, { "timestamp": "2026-09-20T00:00:00.000Z", "event_date": "2026-09-20", "threat_score": 88, "observation_id": "OBS-2026-000258", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Mintplex Labs releases patch v1.11.2 enforcing DOMPurify during streaming." } ], "archetype_match": { "archetype_id": "ARCH-05", "archetype_name": "Patch-Induced Risk Reduction", "description": "Aggressive administrative mitigation and vendor patch availability systematically drives operational exposure down.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-48746", "entity_id": "CVE-2026-48746", "title": "vLLM OpenAI API Authentication Middleware Bypass via ASGI Request Handling Inconsistency", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 93, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 93, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-04-10T00:00:00.000Z", "event_date": "2026-04-10", "threat_score": 93, "observation_id": "OBS-2026-000103", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 93, "observation_id": "OBS-2026-000104", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-37008", "entity_id": "CVE-2026-37008", "title": "CrewAI CodeInterpreterTool Python Sandbox Escape and Host Takeover", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-04-20T00:00:00.000Z", "event_date": "2026-04-20", "threat_score": 91, "observation_id": "OBS-2026-000065", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 91, "observation_id": "OBS-2026-000066", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-40933", "entity_id": "CVE-2026-40933", "title": "Flowise AI MCP Adapter Stdio Command Injection Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-05-14T00:00:00.000Z", "event_date": "2026-05-14", "threat_score": 96, "observation_id": "OBS-2026-000067", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 96, "observation_id": "OBS-2026-000068", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-42249", "entity_id": "CVE-2026-42249", "title": "Ollama for Windows Auto-Updater HTTP Header Path Traversal Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-05-18T00:00:00.000Z", "event_date": "2026-05-18", "threat_score": 92, "observation_id": "OBS-2026-000077", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 92, "observation_id": "OBS-2026-000078", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-5027", "entity_id": "CVE-2026-5027", "title": "Langflow Multipart Form Files Path Traversal and Arbitrary File Overwrite RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 95, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 95, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-05-28T00:00:00.000Z", "event_date": "2026-05-28", "threat_score": 95, "observation_id": "OBS-2026-000105", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 95, "observation_id": "OBS-2026-000106", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-41843", "entity_id": "CVE-2026-41843", "title": "CVE-2026-41843: Path Traversal in Spring Framework Versioned Static Resource Resolution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 76, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 76, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 76, "observation_id": "OBS-2026-000073", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 76, "observation_id": "OBS-2026-000074", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-41849", "entity_id": "CVE-2026-41849", "title": "CVE-2026-41849: Integer Overflow Denial of Service via SpEL String Multiplication in Spring Framework", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 83, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 83, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 83, "observation_id": "OBS-2026-000075", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 83, "observation_id": "OBS-2026-000076", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-46850", "entity_id": "CVE-2026-46850", "title": "CVE-2026-46850: Remote Code Execution via Code Injection in MySQL Shell for VS Code", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 94, "observation_id": "OBS-2026-000087", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 94, "observation_id": "OBS-2026-000088", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-46860", "entity_id": "CVE-2026-46860", "title": "CVE-2026-46860: Unauthenticated Remote Administrative Takeover in MySQL Router", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 96, "observation_id": "OBS-2026-000089", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 96, "observation_id": "OBS-2026-000090", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-46861", "entity_id": "CVE-2026-46861", "title": "CVE-2026-46861: Privilege Escalation and Cluster Takeover in MySQL NDB Operator", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 92, "observation_id": "OBS-2026-000091", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 92, "observation_id": "OBS-2026-000092", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-46862", "entity_id": "CVE-2026-46862", "title": "CVE-2026-46862: Unauthenticated Remote Denial of Service via TLS in MySQL Router", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 82, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 82, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 82, "observation_id": "OBS-2026-000093", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 82, "observation_id": "OBS-2026-000094", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-46870", "entity_id": "CVE-2026-46870", "title": "CVE-2026-46870: Access Control Bypass and Workstation Compromise in MySQL Shell for VS Code", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-06-16T00:00:00.000Z", "event_date": "2026-06-16", "threat_score": 88, "observation_id": "OBS-2026-000095", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 88, "observation_id": "OBS-2026-000096", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-11393", "entity_id": "CVE-2026-11393", "title": "AWS Bedrock AgentCore Multi-Agent Collaboration Poisoning via Triple-Quote Injection RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-06-18T00:00:00.000Z", "event_date": "2026-06-18", "threat_score": 94, "observation_id": "OBS-2026-000037", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 94, "observation_id": "OBS-2026-000038", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-53266", "entity_id": "CVE-2026-53266", "title": "Linux Kernel Netfilter ebtables SNAT ARP Out-of-Bounds Write & Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-06-20T00:00:00.000Z", "event_date": "2026-06-20", "threat_score": 91, "observation_id": "OBS-2026-000111", "cisa_kev": true, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 91, "observation_id": "OBS-2026-000112", "cisa_kev": true, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-41254", "entity_id": "CVE-2026-41254", "title": "CVE-2026-41254: Integer Overflow in Little CMS (lcms2) Affecting Java 2D Color Management", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 84, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 84, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 84, "observation_id": "OBS-2026-000069", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 84, "observation_id": "OBS-2026-000070", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-47057", "entity_id": "CVE-2026-47057", "title": "CVE-2026-47057: Remote Denial of Service in Oracle Java SE Scripting Engine", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 82, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 82, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 82, "observation_id": "OBS-2026-000097", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 82, "observation_id": "OBS-2026-000098", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-47058", "entity_id": "CVE-2026-47058", "title": "CVE-2026-47058: Out-of-Bounds Memory Corruption in Java Scripting DataView Implementation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 86, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 86, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 86, "observation_id": "OBS-2026-000099", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 86, "observation_id": "OBS-2026-000100", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-47063", "entity_id": "CVE-2026-47063", "title": "CVE-2026-47063: Existential Forgery and JAR Verification Bypass in Oracle Java SE Libraries", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 88, "observation_id": "OBS-2026-000101", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 88, "observation_id": "OBS-2026-000102", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-60163", "entity_id": "CVE-2026-60163", "title": "CVE-2026-60163: Local Privilege Escalation and Takeover in MySQL Group Replication", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 86, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 86, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 86, "observation_id": "OBS-2026-000119", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 86, "observation_id": "OBS-2026-000120", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-60316", "entity_id": "CVE-2026-60316", "title": "CVE-2026-60316: Server and Cluster Takeover via MySQL X Plugin Protocol", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 78, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 78, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 78, "observation_id": "OBS-2026-000121", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 78, "observation_id": "OBS-2026-000122", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-60623", "entity_id": "CVE-2026-60623", "title": "CVE-2026-60623: Data Tampering and Information Disclosure in MySQL Connector/J", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 75, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 75, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 75, "observation_id": "OBS-2026-000125", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 75, "observation_id": "OBS-2026-000126", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-61094", "entity_id": "CVE-2026-61094", "title": "CVE-2026-61094: System Compromise via Binary Log Replication Subsystem in MySQL Server", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 80, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 80, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 80, "observation_id": "OBS-2026-000127", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 80, "observation_id": "OBS-2026-000128", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-62574", "entity_id": "CVE-2026-62574", "title": "CVE-2026-62574: Local Privilege Escalation via Install Component in Oracle Java SE and GraalVM", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 85, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 85, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-14T00:00:00.000Z", "event_date": "2026-07-14", "threat_score": 85, "observation_id": "OBS-2026-000131", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 85, "observation_id": "OBS-2026-000132", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-54236", "entity_id": "CVE-2026-54236", "title": "vLLM Multimodal Image Processing Unhandled Exception Memory Pointer Disclosure", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 68, "severity": "MEDIUM", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 68, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-07-29T00:00:00.000Z", "event_date": "2026-07-29", "threat_score": 68, "observation_id": "OBS-2026-000113", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 68, "observation_id": "OBS-2026-000114", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-60592", "entity_id": "CVE-2026-60592", "title": "CVE-2026-60592: Unauthenticated Network Denial of Service and Data Tampering in NDB Operator", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 84, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 84, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-08-18T00:00:00.000Z", "event_date": "2026-08-18", "threat_score": 84, "observation_id": "OBS-2026-000123", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 84, "observation_id": "OBS-2026-000124", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-61308", "entity_id": "CVE-2026-61308", "title": "CVE-2026-61308: Information Disclosure Across Boundaries via HTTP Networking in Java SE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 80, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 80, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-08-18T00:00:00.000Z", "event_date": "2026-08-18", "threat_score": 80, "observation_id": "OBS-2026-000129", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 80, "observation_id": "OBS-2026-000130", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-65182", "entity_id": "CVE-2026-65182", "title": "CVE-2026-65182: Security Constraint Order Bypass and Authorization Failure in Apache Tomcat", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-08-18T00:00:00.000Z", "event_date": "2026-08-18", "threat_score": 92, "observation_id": "OBS-2026-000135", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 92, "observation_id": "OBS-2026-000136", "cisa_kev": false, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-65927", "entity_id": "CVE-2026-65927", "title": "CVE-2026-65927: Access Control Bypass via RewriteValve Off-By-One Error in Apache Tomcat", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 85, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 85, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-08-18T00:00:00.000Z", "event_date": "2026-08-18", "threat_score": 85, "observation_id": "OBS-2026-000139", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 85, "observation_id": "OBS-2026-000140", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-19490", "entity_id": "CVE-2026-19490", "title": "Citrix NetScaler ADC & Gateway Authentication Bypass via Alternate Path", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-08-19T00:00:00.000Z", "event_date": "2026-08-19", "threat_score": 97, "observation_id": "OBS-2026-000041", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-09T00:00:00.000Z", "event_date": "2026-09-09", "threat_score": 97, "observation_id": "OBS-2026-000042", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-46580", "entity_id": "CVE-2026-46580", "title": "Eclipse Theia Workspace Prompt Template Injection & RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-08-28T00:00:00.000Z", "event_date": "2026-08-28", "threat_score": 88, "observation_id": "OBS-2026-000085", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-07T00:00:00.000Z", "event_date": "2026-09-07", "threat_score": 88, "observation_id": "OBS-2026-000086", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-22708", "entity_id": "CVE-2026-22708", "title": "Cursor IDE Terminal Tool Allowlist Bypass via Shell Built-ins to RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-08-30T00:00:00.000Z", "event_date": "2026-08-30", "threat_score": 89, "observation_id": "OBS-2026-000051", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-07T00:00:00.000Z", "event_date": "2026-09-07", "threat_score": 89, "observation_id": "OBS-2026-000052", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-59822", "entity_id": "CVE-2026-59822", "title": "Roundcube Webmail Pre-Auth Postscript Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-01T00:00:00.000Z", "event_date": "2026-09-01", "threat_score": 96, "observation_id": "OBS-2026-000117", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-06T00:00:00.000Z", "event_date": "2026-09-06", "threat_score": 96, "observation_id": "OBS-2026-000118", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-41264", "entity_id": "CVE-2026-41264", "title": "Flowise CSV Agent Prompt Injection to Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-02T00:00:00.000Z", "event_date": "2026-09-02", "threat_score": 94, "observation_id": "OBS-2026-000071", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-07T00:00:00.000Z", "event_date": "2026-09-07", "threat_score": 94, "observation_id": "OBS-2026-000072", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-67277", "entity_id": "CVE-2026-67277", "title": "MikroTik RouterOS Bandwidth-Test Service Missing Authentication & Integer Underflow Kernel Memory Leak / DoS", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-03T00:00:00.000Z", "event_date": "2026-09-03", "threat_score": 88, "observation_id": "OBS-2026-000141", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 88, "observation_id": "OBS-2026-000142", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-84779", "entity_id": "CVE-2026-84779", "title": "WordPress Agentimus AI SEO & MCP Plugin Broken Access Control Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 87, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 87, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-03T00:00:00.000Z", "event_date": "2026-09-03", "threat_score": 87, "observation_id": "OBS-2026-000180", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 87, "observation_id": "OBS-2026-000181", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-85165", "entity_id": "CVE-2026-85165", "title": "n8n Expression Sandbox Bypass via Prototype & Process Globals Resolution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-03T00:00:00.000Z", "event_date": "2026-09-03", "threat_score": 97, "observation_id": "OBS-2026-000184", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 97, "observation_id": "OBS-2026-000185", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-85166", "entity_id": "CVE-2026-85166", "title": "n8n Workflow Tool Node Sub-Workflow Credential Reference Authorization Bypass", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 82, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 82, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-03T00:00:00.000Z", "event_date": "2026-09-03", "threat_score": 82, "observation_id": "OBS-2026-000186", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 82, "observation_id": "OBS-2026-000187", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-85168", "entity_id": "CVE-2026-85168", "title": "n8n Git Node Content-Filter & Merge-Driver Command Injection Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-03T00:00:00.000Z", "event_date": "2026-09-03", "threat_score": 89, "observation_id": "OBS-2026-000188", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 89, "observation_id": "OBS-2026-000189", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-86060", "entity_id": "CVE-2026-86060", "title": "MikroTik RouterOS SSH Argument Delimiter Injection to Administrative Takeover (MikroTrick)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-03T00:00:00.000Z", "event_date": "2026-09-03", "threat_score": 94, "observation_id": "OBS-2026-000194", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 94, "observation_id": "OBS-2026-000195", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-85654", "entity_id": "CVE-2026-85654", "title": "Amazon awslabs dynamodb-mcp-server CDK Generator Template Injection RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 85, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 85, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-04T00:00:00.000Z", "event_date": "2026-09-04", "threat_score": 85, "observation_id": "OBS-2026-000190", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 85, "observation_id": "OBS-2026-000191", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-87911", "entity_id": "CVE-2026-87911", "title": "Amazon awslabs postgres-mcp-server SQL Parser Desynchronization to OS Command Injection", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-04T00:00:00.000Z", "event_date": "2026-09-04", "threat_score": 96, "observation_id": "OBS-2026-000206", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 96, "observation_id": "OBS-2026-000207", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-87999", "entity_id": "CVE-2026-87999", "title": "Open WebUI Azure Reserved IP Classification Bypass Server-Side Request Forgery (SSRF)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 84, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 84, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-04T00:00:00.000Z", "event_date": "2026-09-04", "threat_score": 84, "observation_id": "OBS-2026-000208", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 84, "observation_id": "OBS-2026-000209", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-18486", "entity_id": "CVE-2026-18486", "title": "IBM ContextForge MCP Gateway jq Filter Injection Credential Exfiltration & Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-05T00:00:00.000Z", "event_date": "2026-09-05", "threat_score": 91, "observation_id": "OBS-2026-000039", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 91, "observation_id": "OBS-2026-000040", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-85788", "entity_id": "CVE-2026-85788", "title": "Amazon awslabs mysql-mcp-server Mutable SQL Detection Bypass via Inline Comments", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 86, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 86, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-05T00:00:00.000Z", "event_date": "2026-09-05", "threat_score": 86, "observation_id": "OBS-2026-000192", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 86, "observation_id": "OBS-2026-000193", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-9186", "entity_id": "CVE-2026-9186", "title": "IBM Langflow OSS MCP Configuration Localhost Restriction Bypass Arbitrary IDE File Overwrite", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 90, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 90, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-05T00:00:00.000Z", "event_date": "2026-09-05", "threat_score": 90, "observation_id": "OBS-2026-000233", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 90, "observation_id": "OBS-2026-000234", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-75650", "entity_id": "CVE-2026-75650", "title": "Adobe Commerce & Magento Open Source Server-Side Template Injection Unauthenticated Remote Code Execution (StyleSmuggler)", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 99, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 99, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-07T00:00:00.000Z", "event_date": "2026-09-07", "threat_score": 99, "observation_id": "OBS-2026-000152", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-08T00:00:00.000Z", "event_date": "2026-09-08", "threat_score": 99, "observation_id": "OBS-2026-000153", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-84939", "entity_id": "CVE-2026-84939", "title": "Apache FreeMarker Malformed Locale Path Traversal to Remote Template Injection and Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-08T00:00:00.000Z", "event_date": "2026-09-08", "threat_score": 92, "observation_id": "OBS-2026-000182", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-09T00:00:00.000Z", "event_date": "2026-09-09", "threat_score": 92, "observation_id": "OBS-2026-000183", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-86218", "entity_id": "CVE-2026-86218", "title": "N-able N-central Pre-Authentication Static Code Injection Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-08T00:00:00.000Z", "event_date": "2026-09-08", "threat_score": 98, "observation_id": "OBS-2026-000196", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-57967", "entity_id": "CVE-2026-57967", "title": "Apache ActiveMQ Artemis CORE Protocol Missing Authentication on Session Reattachment Takeover", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-09T00:00:00.000Z", "event_date": "2026-09-09", "threat_score": 96, "observation_id": "OBS-2026-000115", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 96, "observation_id": "OBS-2026-000116", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-87491", "entity_id": "CVE-2026-87491", "title": "Google Chromium V8 Out-of-Bounds Memory Write to Sandbox Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-09T00:00:00.000Z", "event_date": "2026-09-09", "threat_score": 94, "observation_id": "OBS-2026-000205", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-28326", "entity_id": "CVE-2026-28326", "title": "SolarWinds Access Rights Manager (ARM) Hard-coded Cryptographic Key Unauthenticated RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 90, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 90, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 90, "observation_id": "OBS-2026-000059", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 90, "observation_id": "OBS-2026-000060", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-80351", "entity_id": "CVE-2026-80351", "title": "Apache Camel K Dynamic Maven Configuration Eval Injection Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 92, "observation_id": "OBS-2026-000170", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-80352", "entity_id": "CVE-2026-80352", "title": "Apache Camel K Master Trait YAML Injection to Kubernetes Operator Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 91, "observation_id": "OBS-2026-000171", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-76460", "entity_id": "CVE-2026-76460", "title": "DeepSeek-V3 LLM Prompt Execution Sandbox Escape", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 95, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 78, "net_change": 17, "observation_count": 2, "current_acceleration_rate": 2.43, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-10T00:00:00.000Z", "event_date": "2026-09-10", "threat_score": 78, "observation_id": "OBS-2026-000259", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial zero-day weaponization demonstrated in enterprise agentic orchestrator." }, { "timestamp": "2026-09-17T00:00:00.000Z", "event_date": "2026-09-17", "threat_score": 95, "observation_id": "OBS-2026-000260", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "CISA KEV addition confirms active automated exploitation." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-80354", "entity_id": "CVE-2026-80354", "title": "Apache Camel K Multi-Tenant Operator Authorization Bypass via Maven Profiles ValueSources", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-11T00:00:00.000Z", "event_date": "2026-09-11", "threat_score": 88, "observation_id": "OBS-2026-000172", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-20T00:00:00.000Z", "event_date": "2026-09-20", "threat_score": 88, "observation_id": "OBS-2026-000173", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90562", "entity_id": "CVE-2026-90562", "title": "LangBot Password Recovery Low Entropy Authentication Bypass and Admin Takeover", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-11T00:00:00.000Z", "event_date": "2026-09-11", "threat_score": 88, "observation_id": "OBS-2026-000210", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-12T00:00:00.000Z", "event_date": "2026-09-12", "threat_score": 88, "observation_id": "OBS-2026-000211", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90711", "entity_id": "CVE-2026-90711", "title": "proxy-addr Node.js IPv4-Mapped IPv6 CIDR Subnet Parsing IP Spoofing and Trust Bypass", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-11T00:00:00.000Z", "event_date": "2026-09-11", "threat_score": 91, "observation_id": "OBS-2026-000222", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-12T00:00:00.000Z", "event_date": "2026-09-12", "threat_score": 91, "observation_id": "OBS-2026-000223", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90777", "entity_id": "CVE-2026-90777", "title": "ESPnet Pretrained Model Checkpoint Unsafe torch.load Deserialization Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-11T00:00:00.000Z", "event_date": "2026-09-11", "threat_score": 89, "observation_id": "OBS-2026-000226", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90894", "entity_id": "CVE-2026-90894", "title": "Parallels Desktop ParaShells Virtual Machine Host Escape & Local Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-11T00:00:00.000Z", "event_date": "2026-09-11", "threat_score": 92, "observation_id": "OBS-2026-000227", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 92, "observation_id": "OBS-2026-000228", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-67593", "entity_id": "CVE-2026-67593", "title": "Apache ActiveMQ Artemis Pre-Authentication Queue Deletion via Openwire RemoveSubscriptionInfo", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-12T00:00:00.000Z", "event_date": "2026-09-12", "threat_score": 92, "observation_id": "OBS-2026-000143", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-20T00:00:00.000Z", "event_date": "2026-09-20", "threat_score": 92, "observation_id": "OBS-2026-000144", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-76674", "entity_id": "CVE-2026-76674", "title": "HPE Aruba EdgeConnect SD-WAN Operating System Buffer Overflow Full Compromise", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-12T00:00:00.000Z", "event_date": "2026-09-12", "threat_score": 96, "observation_id": "OBS-2026-000155", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 96, "observation_id": "OBS-2026-000156", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90770", "entity_id": "CVE-2026-90770", "title": "Spug Automated Deployment Platform ping_check OS Command Injection Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-13T00:00:00.000Z", "event_date": "2026-09-13", "threat_score": 91, "observation_id": "OBS-2026-000224", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-20T00:00:00.000Z", "event_date": "2026-09-20", "threat_score": 91, "observation_id": "OBS-2026-000225", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-43114", "entity_id": "CVE-2026-43114", "title": "CVE-2026-43114: Linux Kernel Netfilter nft_set_pipapo AVX2 Lookup Expiry Bypass", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 87, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 87, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 87, "observation_id": "OBS-2026-000079", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 87, "observation_id": "OBS-2026-000080", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-43133", "entity_id": "CVE-2026-43133", "title": "CVE-2026-43133: Linux Kernel KVM nSVM VMLOAD/VMSAVE Emulation Hypervisor Escape", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "proof-of-concept" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 88, "observation_id": "OBS-2026-000081", "cisa_kev": false, "exploit_maturity": "proof-of-concept", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 88, "observation_id": "OBS-2026-000082", "cisa_kev": false, "exploit_maturity": "proof-of-concept", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-52924", "entity_id": "CVE-2026-52924", "title": "CVE-2026-52924: Linux Kernel SCTP Stale COOKIE-ECHO Outqueue Purge Use-After-Free", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 91, "observation_id": "OBS-2026-000107", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 91, "observation_id": "OBS-2026-000108", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-52933", "entity_id": "CVE-2026-52933", "title": "CVE-2026-52933: Linux Kernel io_uring/poll Signed Comparison Ownership Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "proof-of-concept" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 89, "observation_id": "OBS-2026-000109", "cisa_kev": false, "exploit_maturity": "proof-of-concept", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 89, "observation_id": "OBS-2026-000110", "cisa_kev": false, "exploit_maturity": "proof-of-concept", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-64268", "entity_id": "CVE-2026-64268", "title": "CVE-2026-64268: Linux Kernel Soft-iWARP (siw) RDMA Read Response Out-of-Bounds Write", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 90, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 90, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 90, "observation_id": "OBS-2026-000133", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 90, "observation_id": "OBS-2026-000134", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-68200", "entity_id": "CVE-2026-68200", "title": "CVE-2026-68200: Linux Kernel ALSA Timer User Trigger Concurrent ioctl Use-After-Free", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "proof-of-concept" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 89, "observation_id": "OBS-2026-000145", "cisa_kev": false, "exploit_maturity": "proof-of-concept", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 89, "observation_id": "OBS-2026-000146", "cisa_kev": false, "exploit_maturity": "proof-of-concept", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-76461", "entity_id": "CVE-2026-76461", "title": "Cisco Secure Email Gateway AsyncOS Email Parsing SQL Injection Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 97, "observation_id": "OBS-2026-000154", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90680", "entity_id": "CVE-2026-90680", "title": "D-Link DIR-823G HNAP1 SetStaticRouteSettings Buffer Overflow", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 95, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 95, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 95, "observation_id": "OBS-2026-000212", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 95, "observation_id": "OBS-2026-000213", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90692", "entity_id": "CVE-2026-90692", "title": "D-Link DIR-878 SetDynamicDNSIPv6Settings Stack Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 94, "observation_id": "OBS-2026-000214", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 94, "observation_id": "OBS-2026-000215", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90693", "entity_id": "CVE-2026-90693", "title": "D-Link DIR-878 SetWan3Settings Stack-Based Buffer Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 94, "observation_id": "OBS-2026-000216", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 94, "observation_id": "OBS-2026-000217", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90699", "entity_id": "CVE-2026-90699", "title": "D-Link DWR-M920 formPinManageSetup OS Command Injection", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 97, "observation_id": "OBS-2026-000218", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 97, "observation_id": "OBS-2026-000219", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-90702", "entity_id": "CVE-2026-90702", "title": "D-Link DWR-M921 formDiskFormat OS Command Injection", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 97, "observation_id": "OBS-2026-000220", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 97, "observation_id": "OBS-2026-000221", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-91843", "entity_id": "CVE-2026-91843", "title": "Check Point Security Management Server Authentication Stack Buffer Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-14T00:00:00.000Z", "event_date": "2026-09-14", "threat_score": 96, "observation_id": "OBS-2026-000231", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 96, "observation_id": "OBS-2026-000232", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-65381", "entity_id": "CVE-2026-65381", "title": "Apple macOS Entitlement Verification Sandbox Escape & Local Privilege Escalation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 89, "observation_id": "OBS-2026-000137", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 89, "observation_id": "OBS-2026-000138", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-83021", "entity_id": "CVE-2026-83021", "title": "Oracle WebLogic Server Web Container Unauthenticated Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 100, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 100, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 100, "observation_id": "OBS-2026-000176", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 100, "observation_id": "OBS-2026-000177", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-86297", "entity_id": "CVE-2026-86297", "title": "D-Link DIR-605 L2TP Parser Off-by-One Buffer Overflow", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 88, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 88, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-15T00:00:00.000Z", "event_date": "2026-09-15", "threat_score": 88, "observation_id": "OBS-2026-000199", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 88, "observation_id": "OBS-2026-000200", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-20192", "entity_id": "CVE-2026-20192", "title": "Cisco Identity Services Engine (ISE) Unauthenticated Authorization Bypass", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-16T00:00:00.000Z", "event_date": "2026-09-16", "threat_score": 98, "observation_id": "OBS-2026-000045", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 98, "observation_id": "OBS-2026-000046", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-20307", "entity_id": "CVE-2026-20307", "title": "Cisco Identity Services Engine Insecure Java Deserialization Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-16T00:00:00.000Z", "event_date": "2026-09-16", "threat_score": 94, "observation_id": "OBS-2026-000047", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 94, "observation_id": "OBS-2026-000048", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-20324", "entity_id": "CVE-2026-20324", "title": "Cisco Secure Firewall Management Center (FMC) sftunnel Command Injection RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 93, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 93, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-16T00:00:00.000Z", "event_date": "2026-09-16", "threat_score": 93, "observation_id": "OBS-2026-000049", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 93, "observation_id": "OBS-2026-000050", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-91749", "entity_id": "CVE-2026-91749", "title": "Google Chrome Workers Subsystem Use-After-Free Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-16T00:00:00.000Z", "event_date": "2026-09-16", "threat_score": 89, "observation_id": "OBS-2026-000229", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 89, "observation_id": "OBS-2026-000230", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-93372", "entity_id": "CVE-2026-93372", "title": "Google Chrome Android WebGL Heap Buffer Overflow & GPU Sandbox Escape", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-17T00:00:00.000Z", "event_date": "2026-09-17", "threat_score": 91, "observation_id": "OBS-2026-000237", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 91, "observation_id": "OBS-2026-000238", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-86296", "entity_id": "CVE-2026-86296", "title": "D-Link DIR-822A udhcpcd Stack-Based Buffer Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 99, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 99, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 99, "observation_id": "OBS-2026-000197", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 99, "observation_id": "OBS-2026-000198", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-86510", "entity_id": "CVE-2026-86510", "title": "D-Link DIR-822A L2TP Parser Out-of-Bounds Write RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 92, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc_public" }, "temporal_metrics": { "initial_score": 92, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 92, "observation_id": "OBS-2026-000201", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 92, "observation_id": "OBS-2026-000202", "cisa_kev": false, "exploit_maturity": "poc_public", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-94089", "entity_id": "CVE-2026-94089", "title": "D-Link DIR-868L webfa_authentication.cgi Stack Buffer Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 99, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 99, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-18T00:00:00.000Z", "event_date": "2026-09-18", "threat_score": 99, "observation_id": "OBS-2026-000241", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 99, "observation_id": "OBS-2026-000242", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-7273", "entity_id": "CVE-2026-7273", "title": "Zyxel GS1900 Smart Managed Switches CGI Program Stack-Based Buffer Overflow RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 95, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 95, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-21T00:00:00.000Z", "event_date": "2026-09-21", "threat_score": 95, "observation_id": "OBS-2026-000149", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 95, "observation_id": "OBS-2026-000150", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-84285", "entity_id": "CVE-2026-84285", "title": "Tuleap Enterprise ALM Workspace Export OS Command Injection", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 89, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 89, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-21T00:00:00.000Z", "event_date": "2026-09-21", "threat_score": 89, "observation_id": "OBS-2026-000178", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 89, "observation_id": "OBS-2026-000179", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-92574", "entity_id": "CVE-2026-92574", "title": "CRI-O Container Checkpoint-Restore Destination Security Context Bypass to Node Escape", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-21T00:00:00.000Z", "event_date": "2026-09-21", "threat_score": 91, "observation_id": "OBS-2026-000235", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 91, "observation_id": "OBS-2026-000236", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-73498", "entity_id": "CVE-2026-73498", "title": "mcp-atlassian Confluence Upload Attachment Arbitrary File Exfiltration", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 77, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 77, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 77, "observation_id": "OBS-2026-000151", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77248", "entity_id": "CVE-2026-77248", "title": "mcp-atlassian Unauthenticated Arbitrary File Read and Attachment Exfiltration", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 86, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 86, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 86, "observation_id": "OBS-2026-000157", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77254", "entity_id": "CVE-2026-77254", "title": "mcp-atlassian Missing Authentication on HTTP Transport Endpoint", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 91, "observation_id": "OBS-2026-000158", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77257", "entity_id": "CVE-2026-77257", "title": "mcp-atlassian Jira Upload Attachment Path Traversal", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 83, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 83, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 83, "observation_id": "OBS-2026-000159", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77258", "entity_id": "CVE-2026-77258", "title": "mcp-atlassian Confluence Attachment Handler Missing Safe Path Validation", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 77, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 77, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 77, "observation_id": "OBS-2026-000160", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77266", "entity_id": "CVE-2026-77266", "title": "mcp-atlassian Absolute Path Traversal Bypass in Attachment Operations", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 81, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 81, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 81, "observation_id": "OBS-2026-000161", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77267", "entity_id": "CVE-2026-77267", "title": "mcp-atlassian Header-Based SSRF in Fetcher Constructor", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 82, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 82, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 82, "observation_id": "OBS-2026-000162", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77268", "entity_id": "CVE-2026-77268", "title": "mcp-atlassian World-Readable Permissions on OAuth Fallback Tokens", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 55, "severity": "MEDIUM", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 55, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 55, "observation_id": "OBS-2026-000163", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77269", "entity_id": "CVE-2026-77269", "title": "mcp-atlassian Incomplete Fix for Path Traversal in Attachment Uploads", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 78, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 78, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 78, "observation_id": "OBS-2026-000164", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77270", "entity_id": "CVE-2026-77270", "title": "mcp-atlassian Blind Path Trust in File Dispatcher", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 78, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 78, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 78, "observation_id": "OBS-2026-000165", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77272", "entity_id": "CVE-2026-77272", "title": "mcp-atlassian Reflected XSS in OAuth Callback Error Response", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 61, "severity": "MEDIUM", "cisa_kev": false, "exploit_maturity": "none" }, "temporal_metrics": { "initial_score": 61, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22T00:00:00.000Z", "threat_score": 61, "observation_id": "OBS-2026-000166", "cisa_kev": false, "exploit_maturity": "none", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-77521", "entity_id": "CVE-2026-77521", "title": "MaxKB Enterprise AI Platform SandboxShellBackend Command Injection and Container Breakout", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 95, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 95, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 95, "observation_id": "OBS-2026-000167", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-01", "archetype_name": "Rapid Exploitation", "description": "Sudden violent risk surge from 0 to 90+ within 72 hours of disclosure, accompanied by automated botnet scanning.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-93616", "entity_id": "CVE-2026-93616", "title": "Check Point Multi-Domain Security Management Server Web Service Directory Traversal and RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 97, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 97, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 97, "observation_id": "OBS-2026-000239", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-93952", "entity_id": "CVE-2026-93952", "title": "Arista VeloCloud Orchestrator On-Premises Input Validation Authentication Bypass and RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 98, "observation_id": "OBS-2026-000240", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-94127", "entity_id": "CVE-2026-94127", "title": "F5 BIG-IP APM TMM Heap-Based Buffer Overflow Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 96, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 96, "net_change": 0, "observation_count": 1, "current_acceleration_rate": 0.5, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 96, "observation_id": "OBS-2026-000243", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-95675", "entity_id": "CVE-2026-95675", "title": "D-Link DAP-1360 Web Management OS Command Injection Root RCE", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 98, "severity": "CRITICAL", "cisa_kev": true, "exploit_maturity": "weaponized" }, "temporal_metrics": { "initial_score": 98, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-22T00:00:00.000Z", "event_date": "2026-09-22", "threat_score": 98, "observation_id": "OBS-2026-000244", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 98, "observation_id": "OBS-2026-000245", "cisa_kev": true, "exploit_maturity": "weaponized", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-02", "archetype_name": "KEV Acceleration", "description": "Moderate initial severity that experiences a dramatic second-order inflection upon formal CISA KEV catalog addition.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-22807", "entity_id": "CVE-2026-22807", "title": "vLLM Auto-Map Dynamic Module Loading Pre-Auth Remote Code Execution", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 94, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "functional" }, "temporal_metrics": { "initial_score": 94, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "critical_acceleration", "inflection_rationale": "Emergency trajectory inflection triggered by active in-the-wild weaponization or CISA KEV catalog inscription." }, "curve": [ { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 94, "observation_id": "OBS-2026-000055", "cisa_kev": false, "exploit_maturity": "functional", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 94, "observation_id": "OBS-2026-000056", "cisa_kev": false, "exploit_maturity": "functional", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-31377", "entity_id": "CVE-2026-31377", "title": "Apache Doris Frontend Meta Service Unauthenticated Metadata Access and Cluster State Spoofing", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 84, "severity": "HIGH", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 84, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 84, "observation_id": "OBS-2026-000061", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 84, "observation_id": "OBS-2026-000062", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } }, { "trajectory_id": "TRAJ-CVE-2026-82331", "entity_id": "CVE-2026-82331", "title": "Apache BuildStream Tar Source Plugin Improper Link Resolution Arbitrary File Overwrite", "methodology_version": "HTR-2.0", "current_risk_state": { "score": 91, "severity": "CRITICAL", "cisa_kev": false, "exploit_maturity": "poc" }, "temporal_metrics": { "initial_score": 91, "net_change": 0, "observation_count": 2, "current_acceleration_rate": 0, "inflection_point": "stable", "inflection_rationale": "Trajectory operating under stable regime with velocity 0 pts/day." }, "curve": [ { "timestamp": "2026-09-23T00:00:00.000Z", "event_date": "2026-09-23", "threat_score": 91, "observation_id": "OBS-2026-000174", "cisa_kev": false, "exploit_maturity": "poc", "summary": "Initial baseline observation created upon public disclosure and ingestion." }, { "timestamp": "2026-09-24T00:00:00.000Z", "event_date": "2026-09-24", "threat_score": 91, "observation_id": "OBS-2026-000175", "cisa_kev": false, "exploit_maturity": "poc", "summary": "State change observed: threat score adjusted by +0 points; CISA KEV or weaponized exploit verified." } ], "archetype_match": { "archetype_id": "ARCH-04", "archetype_name": "Slow Burn", "description": "Gradual persistence expansion across enterprise systems without immediate automated mass exploitation.", "similarity_score": 0.94 } } ]