@blamejs/exceptd-skills 0.12.24 → 0.12.26

package/data/_indexes/chains.json

@@ -1834,6 +1834,326 @@
       "rfc_refs": []
     }
   },
+  "CVE-2024-21626": {
+    "name": "runc /proc/self/fd leak (Leaky Vessels)",
+    "rwep": 75,
+    "cvss": 8.6,
+    "cisa_kev": true,
+    "epss_score": 0.65,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2024-3094": {
+    "name": "xz-utils liblzma backdoor",
+    "rwep": 70,
+    "cvss": 10,
+    "cisa_kev": true,
+    "epss_score": 0.86,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2024-3154": {
+    "name": "CRI-O arbitrary kernel-module load",
+    "rwep": 30,
+    "cvss": 8.1,
+    "cisa_kev": false,
+    "epss_score": 0.012,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2023-43472": {
+    "name": "MLflow path-traversal arbitrary file read",
+    "rwep": 30,
+    "cvss": 7.5,
+    "cisa_kev": false,
+    "epss_score": 0.014,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2020-10148": {
+    "name": "SolarWinds Orion API authentication bypass (SUNBURST chain)",
+    "rwep": 75,
+    "cvss": 9.8,
+    "cisa_kev": true,
+    "epss_score": 0.945,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2023-3519": {
+    "name": "Citrix NetScaler ADC/Gateway unauth RCE (CitrixBleed precursor)",
+    "rwep": 75,
+    "cvss": 9.8,
+    "cisa_kev": true,
+    "epss_score": 0.967,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2024-1709": {
+    "name": "ConnectWise ScreenConnect auth-bypass",
+    "rwep": 75,
+    "cvss": 10,
+    "cisa_kev": true,
+    "epss_score": 0.973,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2026-20182": {
+    "name": "Cisco SD-WAN authentication bypass to admin",
+    "rwep": 65,
+    "cvss": 10,
+    "cisa_kev": true,
+    "epss_score": 0.5,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2024-40635": {
+    "name": "containerd integer overflow IP mask leak",
+    "rwep": 30,
+    "cvss": 5.9,
+    "cisa_kev": false,
+    "epss_score": 0.005,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "MAL-2026-TANSTACK-MINI": {
+    "name": "Mini Shai-Hulud (TanStack worm)",
+    "rwep": 55,
+    "cvss": 9.8,
+    "cisa_kev": false,
+    "epss_score": null,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "MAL-2026-ANTHROPIC-MCP-STDIO": {
+    "name": "Anthropic SDK MCP STDIO command-injection (embargoed)",
+    "rwep": 25,
+    "cvss": 9,
+    "cisa_kev": false,
+    "epss_score": null,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2026-GTIG-AI-2FA": {
+    "name": "GTIG-tracked AI-built 2FA-bypass zero-day (placeholder)",
+    "rwep": 55,
+    "cvss": 8.1,
+    "cisa_kev": false,
+    "epss_score": null,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2026-30623": {
+    "name": "Anthropic MCP SDK stdio command-injection",
+    "rwep": 30,
+    "cvss": 8.8,
+    "cisa_kev": false,
+    "epss_score": 0.02,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2025-12686": {
+    "name": "Synology BeeStation unauth RCE (Pwn2Own Ireland 2025)",
+    "rwep": 50,
+    "cvss": 9.8,
+    "cisa_kev": false,
+    "epss_score": 0.04,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2025-62847": {
+    "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 1/3)",
+    "rwep": 45,
+    "cvss": 9.8,
+    "cisa_kev": false,
+    "epss_score": 0.03,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2025-62848": {
+    "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 2/3)",
+    "rwep": 45,
+    "cvss": 9.8,
+    "cisa_kev": false,
+    "epss_score": 0.03,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2025-62849": {
+    "name": "QNAP QTS/QuTS hero RCE (Pwn2Own Ireland 2025, chain 3/3)",
+    "rwep": 40,
+    "cvss": 8.8,
+    "cisa_kev": false,
+    "epss_score": 0.02,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2025-59389": {
+    "name": "QNAP Hyper Data Protector critical RCE (Pwn2Own Ireland 2025)",
+    "rwep": 45,
+    "cvss": 9.8,
+    "cisa_kev": false,
+    "epss_score": 0.05,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2025-11837": {
+    "name": "QNAP Malware Remover code-injection",
+    "rwep": 40,
+    "cvss": 8,
+    "cisa_kev": false,
+    "epss_score": 0.025,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
+  "CVE-2026-42945": {
+    "name": "NGINX Rift",
+    "rwep": 40,
+    "cvss": 9.2,
+    "cisa_kev": false,
+    "epss_score": null,
+    "referencing_skills": [],
+    "chain": {
+      "cwes": [],
+      "atlas": [],
+      "d3fend": [],
+      "framework_gaps": [],
+      "attack_refs": [],
+      "rfc_refs": []
+    }
+  },
   "CWE-20": {
     "name": "Improper Input Validation",
     "category": "Validation",
@@ -3484,11 +3804,12 @@
       "sector-healthcare",
       "sector-financial",
       "sector-energy",
+      "sector-telecom",
       "api-security",
       "cloud-security",
       "age-gates-child-safety"
     ],
-    "skill_count": 9,
+    "skill_count": 10,
     "chain": {
       "atlas": [
         {
@@ -3501,6 +3822,11 @@
           "name": "Discover ML Model Ontology",
           "tactic": "Discovery"
         },
+        {
+          "id": "AML.T0040",
+          "name": "Tool / Plugin Compromise",
+          "tactic": "Execution"
+        },
         {
           "id": "AML.T0051",
           "name": "LLM Prompt Injection",
@@ -3517,9 +3843,12 @@
         "T0883",
         "T1059",
         "T1068",
+        "T1071",
         "T1078",
+        "T1098",
         "T1110",
         "T1190",
+        "T1199",
         "T1486",
         "T1505",
         "T1530",
@@ -3528,11 +3857,41 @@
         "T1567"
       ],
       "framework_gaps": [
+        {
+          "id": "3GPP-TR-33.926",
+          "framework": "3GPP",
+          "control_name": "3GPP Security Assurance Specification (gNB / eNB)"
+        },
+        {
+          "id": "AU-ISM-1556",
+          "framework": "au-ism",
+          "control_name": "Multi-factor authentication for privileged users (telecom NMS application)"
+        },
+        {
+          "id": "DORA-Art-21-Telecom-ICT",
+          "framework": "DORA",
+          "control_name": "DORA Art. 21 — ICT third-party risk (telecom-adjacent application)"
+        },
+        {
+          "id": "FCC-CPNI-4.1",
+          "framework": "FCC-CPNI",
+          "control_name": "CPNI Annual Certification + Operational Compliance"
+        },
+        {
+          "id": "FCC-Cyber-Incident-Notification-2024",
+          "framework": "FCC",
+          "control_name": "FCC Cyber Incident Notification (4 business days)"
+        },
         {
           "id": "FedRAMP-Rev5-Moderate",
           "framework": "FedRAMP Rev 5 Moderate",
           "control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
         },
+        {
+          "id": "GSMA-NESAS-Deployment",
+          "framework": "GSMA-NESAS",
+          "control_name": "NESAS at-deployment posture"
+        },
         {
           "id": "HIPAA-Security-Rule-164.312(a)(1)",
           "framework": "HIPAA Security Rule (45 CFR § 164.312)",
@@ -3558,11 +3917,21 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ITU-T-X.805",
+          "framework": "ITU-T",
+          "control_name": "ITU-T X.805 — 8-dimension security architecture for end-to-end communications"
+        },
         {
           "id": "NERC-CIP-007-6-R4",
           "framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
           "control_name": "Security event monitoring"
         },
+        {
+          "id": "NIS2-Annex-I-Telecom",
+          "framework": "NIS2",
+          "control_name": "NIS2 Annex I — telecommunications essential entities"
+        },
         {
           "id": "NIS2-Art21-patch-management",
           "framework": "EU NIS2 Directive",
@@ -3622,9 +3991,35 @@
           "id": "SWIFT-CSCF-v2026-1.1",
           "framework": "SWIFT Customer Security Controls Framework v2026",
           "control_name": "SWIFT Environment Protection"
+        },
+        {
+          "id": "UK-CAF-B5",
+          "framework": "UK-CAF",
+          "control_name": "Resilient networks and systems"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-NI",
+          "name": "Network Isolation",
+          "tactic": "Isolate"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-NTPM",
+          "name": "Network Traffic Policy Mapping",
+          "tactic": "Model"
         }
       ],
-      "d3fend": [],
       "rfc_refs": [
         {
           "id": "RFC-6749",
@@ -3666,6 +4061,11 @@
           "title": "HTTP Message Signatures",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-9622",
+          "title": "An Architecture for Transport Services",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9700",
           "title": "Best Current Practice for OAuth 2.0 Security",
@@ -3685,9 +4085,10 @@
     "referencing_skills": [
       "identity-assurance",
       "ot-ics-security",
-      "sector-energy"
+      "sector-energy",
+      "sector-telecom"
     ],
-    "skill_count": 3,
+    "skill_count": 4,
     "chain": {
       "atlas": [
         {
@@ -3695,6 +4096,11 @@
           "name": "ML Supply Chain Compromise",
           "tactic": "Initial Access"
         },
+        {
+          "id": "AML.T0040",
+          "name": "Tool / Plugin Compromise",
+          "tactic": "Execution"
+        },
         {
           "id": "AML.T0051",
           "name": "LLM Prompt Injection",
@@ -3705,12 +4111,45 @@
         "T0855",
         "T0883",
         "T1068",
+        "T1071",
         "T1078",
+        "T1098",
         "T1110",
         "T1190",
+        "T1199",
         "T1556"
       ],
       "framework_gaps": [
+        {
+          "id": "3GPP-TR-33.926",
+          "framework": "3GPP",
+          "control_name": "3GPP Security Assurance Specification (gNB / eNB)"
+        },
+        {
+          "id": "AU-ISM-1556",
+          "framework": "au-ism",
+          "control_name": "Multi-factor authentication for privileged users (telecom NMS application)"
+        },
+        {
+          "id": "DORA-Art-21-Telecom-ICT",
+          "framework": "DORA",
+          "control_name": "DORA Art. 21 — ICT third-party risk (telecom-adjacent application)"
+        },
+        {
+          "id": "FCC-CPNI-4.1",
+          "framework": "FCC-CPNI",
+          "control_name": "CPNI Annual Certification + Operational Compliance"
+        },
+        {
+          "id": "FCC-Cyber-Incident-Notification-2024",
+          "framework": "FCC",
+          "control_name": "FCC Cyber Incident Notification (4 business days)"
+        },
+        {
+          "id": "GSMA-NESAS-Deployment",
+          "framework": "GSMA-NESAS",
+          "control_name": "NESAS at-deployment posture"
+        },
         {
           "id": "IEC-62443-3-3",
           "framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
@@ -3721,11 +4160,21 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ITU-T-X.805",
+          "framework": "ITU-T",
+          "control_name": "ITU-T X.805 — 8-dimension security architecture for end-to-end communications"
+        },
         {
           "id": "NERC-CIP-007-6-R4",
           "framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
           "control_name": "Security event monitoring"
         },
+        {
+          "id": "NIS2-Annex-I-Telecom",
+          "framework": "NIS2",
+          "control_name": "NIS2 Annex I — telecommunications essential entities"
+        },
         {
           "id": "NIS2-Art21-patch-management",
           "framework": "EU NIS2 Directive",
@@ -3755,9 +4204,35 @@
           "id": "SOC2-CC6-logical-access",
           "framework": "SOC 2 (AICPA Trust Services Criteria)",
           "control_name": "Logical and Physical Access Controls"
+        },
+        {
+          "id": "UK-CAF-B5",
+          "framework": "UK-CAF",
+          "control_name": "Resilient networks and systems"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-NI",
+          "name": "Network Isolation",
+          "tactic": "Isolate"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-NTPM",
+          "name": "Network Traffic Policy Mapping",
+          "tactic": "Model"
         }
       ],
-      "d3fend": [],
       "rfc_refs": [
         {
           "id": "RFC-6749",
@@ -3779,6 +4254,11 @@
           "title": "JSON Web Token Best Current Practices",
           "status": "Best Current Practice"
         },
+        {
+          "id": "RFC-9622",
+          "title": "An Architecture for Transport Services",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9700",
           "title": "Best Current Practice for OAuth 2.0 Security",
@@ -6348,9 +6828,10 @@
       "mcp-agent-trust",
       "attack-surface-pentest",
       "webapp-security",
+      "sector-telecom",
       "api-security"
     ],
-    "skill_count": 4,
+    "skill_count": 5,
     "chain": {
       "atlas": [
         {
@@ -6368,6 +6849,11 @@
           "name": "Discover ML Model Ontology",
           "tactic": "Discovery"
         },
+        {
+          "id": "AML.T0040",
+          "name": "Tool / Plugin Compromise",
+          "tactic": "Execution"
+        },
         {
           "id": "AML.T0043",
           "name": "Craft Adversarial Data",
@@ -6386,19 +6872,53 @@
       ],
       "attack_refs": [
         "T1059",
+        "T1071",
         "T1078",
+        "T1098",
         "T1133",
         "T1190",
         "T1195.001",
+        "T1199",
         "T1505",
+        "T1556",
         "T1567"
       ],
       "framework_gaps": [
+        {
+          "id": "3GPP-TR-33.926",
+          "framework": "3GPP",
+          "control_name": "3GPP Security Assurance Specification (gNB / eNB)"
+        },
         {
           "id": "ALL-MCP-TOOL-TRUST",
           "framework": "ALL",
           "control_name": "MCP/Agent Tool Trust Boundaries"
         },
+        {
+          "id": "AU-ISM-1556",
+          "framework": "au-ism",
+          "control_name": "Multi-factor authentication for privileged users (telecom NMS application)"
+        },
+        {
+          "id": "DORA-Art-21-Telecom-ICT",
+          "framework": "DORA",
+          "control_name": "DORA Art. 21 — ICT third-party risk (telecom-adjacent application)"
+        },
+        {
+          "id": "FCC-CPNI-4.1",
+          "framework": "FCC-CPNI",
+          "control_name": "CPNI Annual Certification + Operational Compliance"
+        },
+        {
+          "id": "FCC-Cyber-Incident-Notification-2024",
+          "framework": "FCC",
+          "control_name": "FCC Cyber Incident Notification (4 business days)"
+        },
+        {
+          "id": "GSMA-NESAS-Deployment",
+          "framework": "GSMA-NESAS",
+          "control_name": "NESAS at-deployment posture"
+        },
         {
           "id": "ISO-27001-2022-A.8.28",
           "framework": "ISO/IEC 27001:2022",
@@ -6409,6 +6929,16 @@
           "framework": "ISO/IEC 27001:2022",
           "control_name": "Outsourced development"
         },
+        {
+          "id": "ITU-T-X.805",
+          "framework": "ITU-T",
+          "control_name": "ITU-T X.805 — 8-dimension security architecture for end-to-end communications"
+        },
+        {
+          "id": "NIS2-Annex-I-Telecom",
+          "framework": "NIS2",
+          "control_name": "NIS2 Annex I — telecommunications essential entities"
+        },
         {
           "id": "NIS2-Art21-patch-management",
           "framework": "EU NIS2 Directive",
@@ -6473,6 +7003,11 @@
           "id": "SWIFT-CSCF-v2026-1.1",
           "framework": "SWIFT Customer Security Controls Framework v2026",
           "control_name": "SWIFT Environment Protection"
+        },
+        {
+          "id": "UK-CAF-B5",
+          "framework": "UK-CAF",
+          "control_name": "Resilient networks and systems"
         }
       ],
       "d3fend": [
@@ -6496,15 +7031,30 @@
           "name": "Executable Hashbased Allowlist",
           "tactic": "Harden"
         },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
         {
           "id": "D3-MFA",
           "name": "Multi-factor Authentication",
           "tactic": "Harden"
         },
+        {
+          "id": "D3-NI",
+          "name": "Network Isolation",
+          "tactic": "Isolate"
+        },
         {
           "id": "D3-NTA",
           "name": "Network Traffic Analysis",
           "tactic": "Detect"
+        },
+        {
+          "id": "D3-NTPM",
+          "name": "Network Traffic Policy Mapping",
+          "tactic": "Model"
         }
       ],
       "rfc_refs": [
@@ -6538,6 +7088,11 @@
           "title": "HTTP Message Signatures",
           "status": "Proposed Standard"
         },
+        {
+          "id": "RFC-9622",
+          "title": "An Architecture for Transport Services",
+          "status": "Proposed Standard"
+        },
         {
           "id": "RFC-9700",
           "title": "Best Current Practice for OAuth 2.0 Security",