CVEasy Threat Intel Payloads

Quarterly free drops of attack payload manifests for community use. Hand-curated from the prior 90+ days of threat intel by CVEasy AI.

Each drop ships:

• Payload manifest per CVE (YAML, machine-readable)
• TRIS-lite 3-layer scoring (CVSS, EPSS, KEV)
• Reproducible lab setup pointing at vulhub or hand-authored docker-compose
• Plain-English customer brief: what the bug is, what it proves, how to fix
• Links to all public PoCs we consulted

Free. MIT licensed. No signup. Released the first Monday of every quarter.

.
├── releases/
│   ├── 2026-Q2/                    Current drop. 2 flagship payloads.
│   │   ├── README.md               What's in this drop
│   │   └── payloads/
│   │       └── CVE-XXXX-NNNN.yaml
│   └── 2026-Q1/                    Prior drops archived here
├── schema/
│   └── payload.schema.json         JSON Schema for validation
├── tools/
│   └── validate.py                 Validate any payload YAML against schema
└── docs/
    ├── payload-format.md           Schema explained
    └── tris-scoring.md             How TRIS scoring works

Why this exists

Every infosec team running vulnerability management has the same problem: too many CVEs, not enough context. CVSS scores tell you a bug is bad. They do not tell you whether it matters to you.

We built TRIS, a 12-layer risk scoring framework (patent pending), to fix that. The full TRIS engine lives in the paid CVEasy AI app, which scans your environment, scores every CVE against your specific posture, and ships continuously updated payloads daily.

This repo is the free public slice: a quarterly drop of payload manifests for the highest-impact CVEs from the prior quarter. Read them, run them in a lab, use them to train your team. If you want continuous updates plus automated scanning plus 12-layer scoring instead of 3, you upgrade.

Release schedule

Quarter	Drop date	Payloads	Status
2026-Q2	2026-05-19	2	current
2026-Q3	2026-08-04	TBD	planned
2026-Q4	2026-11-03	TBD	planned
2027-Q1	2027-02-02	TBD	planned

Each drop targets the first Monday after the quarter closes, giving us 30+ days of post-quarter threat intel to curate from.

How to use a payload

1. Open the YAML file under releases/<quarter>/payloads/. Read the overview block to understand the bug.
2. Set up the lab per the test.lab_setup field. Most use vulhub compose files; some have hand-authored Dockerfiles linked in this repo.
3. Run the public PoC listed under test.public_poc against the lab target.
4. Verify the expected outcome in test.expected_outcome actually occurs.
5. Apply the fix in remediation.primary and re-run; the exploit should now fail.

These payloads are descriptive, not weaponized. We point at public PoCs that already exist. We do not ship novel exploit code in this repo.

Free vs CVEasy AI

This repo covers ~20 CVEs per year (5 per quarterly drop). CVEasy AI covers:

Capability	Free Quarterly Drop	CVEasy AI
New payloads	5 per quarter	Daily, ~3 to 5 per week
Scoring layers	3 (CVSS, EPSS, KEV)	Full 12-layer TRIS
Automated scanning of your environment	No	Yes
Continuous monitoring + alerts	No	Yes
Customer-deliverable HTML reports	No	Yes (audit binder grade)
AI Red-Team Mode (autonomous chain attacks)	No	Yes ($999 tier)
BASzy validation against your inventory	No	Yes
Curated zero-day spotlight	No	Yes ($999 tier)

Pricing and tier details at cveasyai.com.

Validation

To validate a payload YAML against our schema before submitting a PR or before consuming a copy you forked:

python3 tools/validate.py releases/2026-Q2/payloads/CVE-2022-0847.yaml

Contributing

We accept community-submitted payloads via PR. The bar:

• Must be a CVE that has been public for 90+ days
• Must include a working lab setup (vulhub reference preferred)
• Must include public PoC URLs (we will not accept proprietary exploit code)
• Must include customer_brief text in the practitioner voice (see docs/payload-format.md)
• Must validate against schema/payload.schema.json

Contributors are credited in the quarterly drop README.

Responsible use

These payloads are descriptive of public vulnerabilities for educational, lab, and authorized-pentest use only.

Run them only against:

• Lab environments you own
• Test systems you have explicit written authorization to test
• Production systems where you have an authorized engagement and a maintenance window

Do not run them against:

• Systems you do not own or do not have authorization to test
• Production environments without coordination
• Third-party services governed by terms of service or abuse policies

See SECURITY.md for full responsible-use policy and how to report a vulnerability in this repo.

License

MIT. See LICENSE. Fork, modify, redistribute. Attribution appreciated.

Author

CVEasy AI by BlueTeamAutomation. Founded by Topher Boker (MIL4N). 10 patents filed on TRIS scoring, BAS methodology, and AI chatbot pentest.

---

MIL4N