Cumulative share of published CVEs that have received at least one exploitation sighting ('exploited' or 'published-proof-of-concept'), bucketed by the date of the sighting rather than the CVE year. Each bucket reports the running totals up to that point, so the series is monotonic in its inputs and reflects how the overall exploited fraction evolves over time. Returns the trailing 'window' buckets (default 30).