Writeup & CVE Ingest (Repeatable Pipeline)

One-shot enrichment sprints (like the 2026-09 10-class pass) burn out fast. This skill is the repeatable one: turn a single good writeup or advisory into a durable, cited, deduped skill patch in one sitting — without bloating the library.

When to run

• Start of a campaign on a class your library is weak on (spot-check the target hunt-* skill's ## CVE & Writeup Grounding (2024–2026) table — if it lacks recent rows for the class, run this).
• After an advisory wave: Keycloak, Spring / Spring Security, DOMPurify, axios, nextjs, OData/CDS updates drop in bursts — one event usually ships several CVEs at once.
• A peer writeup is relevant ("I read that Shopify BOLA post and I want it in my SSRF skill").
• An OOB/version finding on your target matches a class you plan to spend time on (e.g., target runs Keycloak 26.x → ingest the KC CVE set before testing).

Source queries (5 minutes, saved for replay)

Run these via websearch, in this order; keep the primary sources (vendor advisory / GHSA / H1 report / portswigger-research / assetnote) — not aggregator summaries.

1. "<class>" "bug bounty" writeup 2024..2026 site:hackerone.com OR site:portswigger.net OR site:assetnote.io
2. <tool/framework> security advisory 2024..2026 (GHSA / vendor security page)
3. <framework> CVE 2024 OR CVE 2025 OR CVE 2026 RCE OR XSS OR SSRF OR IDOR OR "privilege escalation"
4. If the class is Microsoft/OAuth/Keycloak-shaped: check the vendor's fixed-version matrix (advisory lists the patched version — the entire "still vulnerable <= X" story maps straight to live targets).