KCV Watch: possible exploit chains for teams to research

Chain candidates: pairs of CVEs whose extracted exploit capabilities connect, one step feeding the next, or whose records tie them together (exploitation reports or field sightings on both within 90 days, an authentication bypass disclosed with a partner under one narrow advisory or fix, or two products that CISA, a CNA or community sources tie together), derived from exploit-capability analysis by the CVE Security intelligence team. Three tiers defined by a likelihood band: pairs with these signals are estimated as possible chains at a rate of at least one in 25 (A), one in 100 (B) or one in 1,000 (C); the estimate is counted against cited chains on pairs whose later CVE is at least 90 days old. A pair reaches tier A only when the capability analysis documents a handoff between the two CVEs, and a pair of two products reaches at most tier B. The site's pages list tiers A and B; tier C is returned here (tier=C), on each CVE record under chains.candidates and in the download /api/export/kcv-watch.jsonl.gz, one pair per line, rebuilt nightly. Each row carries listed_on_site. The capabilities of every CVE with a CVSS vector come from a fixed rule over the vector, the weakness class and the description, joined with a model's reading of exploit code and patch diffs where the dataset holds them. Every row carries both CVEs with KEV status, EPSS and publication date, the tier and its rule, the lane, the reasons, the basis, the product the pair shares with its page, the bridge, the capability-match grade, the entry step where one is extracted and a one-sentence caption. A row carries no rate of its own; a candidate is not a confirmed chain. set=breaking returns Breaking watch in place of the tiers: connected same-product pairs with an exploitation report or field sighting, whatever their tier (null below tier C), each with since and until (the first and last day of its stay, inclusive), its basis, caption and lane; the set is small and comes whole, and the watch adds no rate of its own. Keyed; private-cacheable for 900s.