Editorial Evidence Review
editorial · 19 retained records
Selective historical baseline reviewed on 2026-10-26, not complete or live worldwide monitoring. Dates describe cited disclosures, not necessarily incident occurrence. Known exploitation does not establish continuing attacks today, zero-day use, or attacker AI use. This sample is not a denominator for global or AI incident trends.
A manually reviewed, dated editorial sample, not a live feed. Source claims and dates remain tied to each record; no invented scores or trends.
Last successful retrieval: Not yet recorded.
CISA Known Exploited Vulnerabilities
live · 1769 retained records
The full successfully validated KEV catalog, without a newest-record slice.
Known exploitation is not necessarily a zero-day. KEV-only publication dates denote catalog additions, not initial disclosure. Due dates concern covered US federal agencies, not your SLA. The last complete catalog is retained for 30 days; oversized or incomplete replacements are rejected, not truncated.
Last successful retrieval: Nov 9, 2026, 02:35 UTC.
Source documentation
GitHub Public Security Advisories
cached · 940 retained records
GitHub-reviewed public advisories, sorted by update date; at most 3 cursor pages of 100 records per cycle, without authentication.
Not the entire advisory database. GitHub review is upstream review, not local editorial review or proof of remediation. Withdrawn advisories are excluded. Retained union is bounded to 2,000 records updated within 180 days; public API rate limits can reduce coverage.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Public source returned an error. (HTTP 403)
Source documentation
JPCERT/CC Japan Advisories
live · 60 retained records
Current Japanese-language alerts and weekly report entries, with the exact article or weekly-report anchor.
RSS usually supplies only a Japanese title and date. Titles matching JPCERT/CC's fixed patterns are shown in English via a deterministic glossary translation with the original Japanese retained; unmatched titles stay in Japanese rather than being guessed. No affected-version detail is invented. Japan denotes this advisory audience, not a scan or proof of exposure. Up to 500 records are retained for 365 days.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
Google Project Zero Research
live · 11 retained records
Security-research entries in the official Atom feed, including explicit AI-defense research when present; no archive crawling.
The official feed is large but contains a bounded current entry list. Excerpts are not full articles. Ordinary fuzzing, automation, and exploit research are not classified as AI. Up to 250 records are retained for 730 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
Google Security Research
live · 47 retained records
At most the 50 entries supplied by the official Google Security RSS endpoint; security-topic filtering and conservative, source-linked AI classifications.
Not all Google research or all AI defense. Product security and prompt-injection research do not establish attacker AI use. Excerpts are not independently reproduced findings. Up to 250 records are retained for 730 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
NVD Recently Published CVEs
live · 6000 retained records
Every CVE in the NVD, from any vendor worldwide, that any scorer (the vendor/CNA, NVD, or CISA) rates HIGH or CRITICAL, or that CISA's assessment reports as actively exploited. A 14-day backfill on first run, then every CVE modified since the last successful retrieval.
Medium and low severity CVEs are not ingested; unscored CVEs appear once scored. The CNA (vendor) score is preferred over NVD's own when both exist. NVD publication is not evidence of exploitation. Up to 6,000 records are retained for 120 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
BleepingComputer Security Reporting
unavailable · 0 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Not yet recorded.
Public source returned an error. (HTTP 403)
Source documentation
The Hacker News
live · 90 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Nov 9, 2026, 02:35 UTC.
Source documentation
SecurityWeek
live · 47 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
Help Net Security
live · 33 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
The Record (Recorded Future News)
live · 6 retained records
Breach, vulnerability, and exploitation reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
Axios
live · 4 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
TechCrunch Security
live · 5 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
WIRED Security
live · 7 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
The Verge (AI)
live · 0 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
404 Media
live · 0 retained records
General technology and business news, filtered to security stories and incidents involving AI systems; everything else in the feed is skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days. An AI role (acted on its own, used by attackers, flawed or attacked) is assigned only when the headline or excerpt says so.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
Have I Been Pwned
live · 120 retained records
Breaches loaded into Have I Been Pwned in the last year: breached organization, account count, exposed data types, breach and load dates, and the organization's disclosure when HIBP links one.
HIBP covers breaches whose data it obtained and loaded; many breaches never appear there. Counts are accounts in the loaded data, not necessarily people. Unverified breaches are labeled as such; fabricated, spam-list, retired, and sensitive breaches are skipped. Up to 400 records are retained for 365 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
DataBreaches.net
live · 66 retained records
Breach and incident reporting selected from the current syndication feed, with exact article links.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
The HIPAA Journal
live · 27 retained records
Healthcare breach and security reporting selected from the current feed; compliance guides and opinion are skipped.
Reporting, not independently primary-confirmed or locally reviewed. A record is marked as known exploitation only when the headline or excerpt explicitly reports exploitation. Headline filtering is not a complete census. No fabricated scores, losses, CVEs, or AI attribution. Retained for 90 days.
Last successful retrieval: Nov 9, 2026, 02:30 UTC.
Source documentation
Anthropic
live · 1 retained records
Anthropic news posts about misuse, threats, safety, and security, found through its sitemap (it publishes no feed); at most 8 new pages are read per run.
The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
OpenAI
live · 68 retained records
OpenAI news posts about misuse, threats, safety, and security; product and business posts are skipped.
The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
Google DeepMind
live · 1 retained records
Google DeepMind blog posts about misuse, threats, safety, and security; product and research-only posts are skipped.
The company's own disclosure about its systems or threats it observed: authoritative for what the company says, not independent verification. Only posts about misuse, threats, safety, or security are kept. Retained for 730 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
Microsoft Security blog
live · 9 retained records
Microsoft Threat Intelligence and security posts: vulnerabilities, threat actors, and AI misuse it observed.
The publishing company's own reporting about threats it observed; not independently confirmed here. Marketing posts are skipped. Up to 300 records are retained for 365 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
1 malformed upstream records were excluded.
Source documentation
AI Incident Database
live · 71 retained records
Reports newly added to the AI Incident Database (Responsible AI Collaborative) that concern security or misuse (deepfakes, scams, influence operations, attacks on or by AI, unauthorized actions), each linking to the original report on its publisher's site. Vehicle crashes, lawsuits, bias, errors, and other non-security harms are skipped; non-English reports usually are too, because the filter reads English.
Inclusion in the database means an editor judged it an AI incident; it is not an independent investigation. The linked report is the evidence. An AI role is assigned only when the report title states it. Up to 500 records are retained for 365 days.
Last successful retrieval: Nov 9, 2026, 02:16 UTC.
Source documentation
FIRST EPSS
cached · 16180 retained records
Measured EPSS rows for real CVE identifiers already in this corpus; batches of at most 80 identifiers and under 1,900 CVE-query characters.
Daily model scores estimate exploitation in the following 30 days, not organizational exposure. Missing CVEs receive no default score. Exact scoring dates and per-CVE/date API evidence are retained for 30 days; scores older than 2 days are stale even if a retrieval succeeds.
Last successful retrieval: Nov 9, 2026, 02:36 UTC.
Source documentation
CVE Program CVSS Enrichment
cached · 757 retained records
At most 8 published per-CVE documents per cycle, one request at a time, for missing CVSS or an editorial CVE-API measurement not yet rechecked; no NVD polling.
Targeted enrichment, not full CVE coverage. CNA CVSS is preferred; if absent, an explicitly labeled public ADP assessment can supply the actual metric and authoritative source update date. A document with no usable CVSS is not a metric-ingestion success. Unscored targets are deferred for 24 hours. Up to 4,000 enrichments are retained for 30 days.
Last successful retrieval: Nov 6, 2026, 12:56 UTC.
Public source returned an error. (HTTP 404)
Source documentation
NVD CVSS for Known Exploited CVEs
live · 1769 retained records
Once a day, the NVD CVSS score for every CVE in CISA's Known Exploited Vulnerabilities catalog (NVD API hasKev, about 4 pages), so older exploited CVEs are scored even when the CVE record itself has no CVSS.
Used only when a record has no CNA or ADP score. The CNA's own score in NVD is preferred over NVD's, and CVSS 4.0/3.x over 2.0. A score describes severity, not exploitation or exposure.
Last successful retrieval: Nov 8, 2026, 20:31 UTC.
Source documentation