@[Andrey Turkin] CISA does that for me with their KEV (Known Exploited Vulnerabilities) Catalog. These are known to have already been exploited in the wild. I realized after I was using this as a datasource that the AI would probably always evaluate these as a high priority and requiring immediate mitigation. Oh well.
You can also find lists that are "just" CVEs and look really severe, but can't be exploited due to a variety of things. This is where I would leverage the AI tools companies are giving access to their source code and work collaboratively to determine if it's exploitable in that particularly setup/configuration/environment/etc.
