I don't have source data now but in Germany it is forbidden share/sell working exploits codes. In Poland it was introduced not long ago that it is criminal offence to have any offensive cyber tools. I guess there is also quite some regulations on export of tools from US, just like encryption tools.

So there are regulations, but they are unenforceable.