@blamejs/exceptd-skills 0.12.31 → 0.12.32

package/data/_indexes/frequency.json

@@ -2519,6 +2519,8 @@
       "AU-Essential-8-Backup",
       "AU-Essential-8-MFA",
       "AU-Essential-8-Patch",
+      "CIS-Controls-v8-10.1",
+      "DORA-Art-9",
       "DORA-Art28",
       "DORA-IA-CTPP-Oversight",
       "DORA-ITS-TLPT",
@@ -2534,8 +2536,15 @@
       "HIPAA-Security-Rule-2026-NPRM-164.310",
       "HIPAA-Security-Rule-2026-NPRM-164.312",
       "HIPAA-Security-Rule-2026-NPRM-164.314",
+      "ISO-27001-2022-A.8.7",
+      "NIS2-Art21-identity-management",
       "NIS2-Art21-incident-handling",
+      "NIS2-Art21-vulnerability-management",
+      "NIST-800-53-AC-3",
+      "NIST-800-53-AC-6",
+      "NIST-800-53-SC-44",
       "NIST-800-53-SI-10",
+      "OWASP-LLM-Top-10-2025-LLM05",
       "PCI-DSS-4.0.1-11.6.1",
       "PCI-DSS-4.0.1-12.10.7",
       "PCI-DSS-4.0.1-12.3.3",

package/data/cve-catalog.json

@@ -2769,8 +2769,6 @@
     "rwep_correction_note": "v0.12.30: canonicalized rwep_factors to satisfy Shape B invariant (Σ factors === rwep_score). Prior values used non-canonical weights and/or blast_radius > 30 (over-cap). Stored rwep_score unchanged; factor block now reproducible from canonical RWEP_WEIGHTS + operational fields."
   },
   "CVE-2026-0300": {
-    "_draft": true,
-    "_auto_imported": true,
     "name": "PAN-UID — Palo Alto Networks PAN-OS User-ID Authentication Portal RCE",
     "type": "rce",
     "cvss_score": 9.3,
@@ -2874,11 +2872,11 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Internal discovery by Palo Alto Networks PSIRT during proactive authentication-subsystem auditing; vendor advisory published 2026-05-13 alongside CISA KEV listing 2026-05-06. No AI-tool credit. Source: https://security.paloaltonetworks.com/CVE-2026-0300 and https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog."
+    "discovery_attribution_note": "Internal discovery by Palo Alto Networks PSIRT during proactive authentication-subsystem auditing; vendor advisory published 2026-05-13 alongside CISA KEV listing 2026-05-06. No AI-tool credit. Source: https://security.paloaltonetworks.com/CVE-2026-0300 and https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog.",
+    "_editorial_promoted": "2026-05-15",
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
   },
   "CVE-2026-39987": {
-    "_draft": true,
-    "_auto_imported": true,
     "name": "Marimo Python Notebook Pre-Auth WebSocket Terminal RCE",
     "type": "rce",
     "cvss_score": 9.3,
@@ -2989,11 +2987,11 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Marimo team's security review of the terminal subsystem prompted by Sysdig honeypot evidence; vendor advisory + Sysdig blog jointly disclosed 2026-04-21 / 2026-04-23. No AI-tool credit for the discovery; the vulnerable component IS an AI/ML developer surface but the bug was found by conventional human review. Source: https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface and https://github.com/marimo-team/marimo/security/advisories."
+    "discovery_attribution_note": "Marimo team's security review of the terminal subsystem prompted by Sysdig honeypot evidence; vendor advisory + Sysdig blog jointly disclosed 2026-04-21 / 2026-04-23. No AI-tool credit for the discovery; the vulnerable component IS an AI/ML developer surface but the bug was found by conventional human review. Source: https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface and https://github.com/marimo-team/marimo/security/advisories.",
+    "_editorial_promoted": "2026-05-15",
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
   },
   "CVE-2026-6973": {
-    "_draft": true,
-    "_auto_imported": true,
     "name": "Ivanti EPMM Authenticated-Admin RCE",
     "type": "rce",
     "cvss_score": 7.2,
@@ -3099,11 +3097,11 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Internal Ivanti product-security discovery; vendor advisory + CISA KEV listing jointly published 2026-05-07 with a 3-day due date reflecting confirmed in-wild exploitation. No AI-tool credit. Source: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-CVE-2026-6973 and https://www.helpnetsecurity.com/2026/05/08/ivanti-epmm-zero-day-cve-2026-6973/."
+    "discovery_attribution_note": "Internal Ivanti product-security discovery; vendor advisory + CISA KEV listing jointly published 2026-05-07 with a 3-day due date reflecting confirmed in-wild exploitation. No AI-tool credit. Source: https://forums.ivanti.com/s/article/Security-Advisory-EPMM-CVE-2026-6973 and https://www.helpnetsecurity.com/2026/05/08/ivanti-epmm-zero-day-cve-2026-6973/.",
+    "_editorial_promoted": "2026-05-15",
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
   },
   "CVE-2026-42897": {
-    "_draft": true,
-    "_auto_imported": true,
     "name": "Microsoft Exchange OWA Stored XSS / Spoofing Zero-Day",
     "type": "stored-xss",
     "cvss_score": 8.1,
@@ -3212,11 +3210,11 @@
       "forensic_note": "Defenders should snapshot the OWA IIS logs + Exchange transport logs covering the attack window BEFORE applying EEMS rules; the EEMS rule strips the payload pattern from subsequent renders, but historical IIS log entries retain the request shape that surfaces the exploitation."
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Microsoft MSRC discovery from in-the-wild exploitation telemetry; disclosed 2026-05-15 with concurrent CISA KEV listing and Exchange Team blog publication. No binary patch at disclosure; mitigation via Exchange Emergency Mitigation Service. No AI-tool credit. Source: https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498 and https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/."
+    "discovery_attribution_note": "Microsoft MSRC discovery from in-the-wild exploitation telemetry; disclosed 2026-05-15 with concurrent CISA KEV listing and Exchange Team blog publication. No binary patch at disclosure; mitigation via Exchange Emergency Mitigation Service. No AI-tool credit. Source: https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498 and https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/.",
+    "_editorial_promoted": "2026-05-15",
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
   },
   "CVE-2026-32202": {
-    "_draft": true,
-    "_auto_imported": true,
     "name": "Microsoft Windows Shell LNK Mark-of-the-Web Bypass (APT28)",
     "type": "protection-mechanism-failure",
     "cvss_score": 7.5,
@@ -3325,11 +3323,11 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "APT28 (Fancy Bear) in-the-wild weaponization observed by Microsoft + Help Net Security 2026-04-28; CVE-2026-32202 represents an incomplete-patch re-exploit of CVE-2026-21510 and chains with CVE-2026-21513 in the operational APT28 toolkit. Nation-state tradecraft; no AI-tool credit on either the discovery or weaponization side. Source: https://www.helpnetsecurity.com/2026/04/29/windows-cve-2026-32202-exploited/ and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202."
+    "discovery_attribution_note": "APT28 (Fancy Bear) in-the-wild weaponization observed by Microsoft + Help Net Security 2026-04-28; CVE-2026-32202 represents an incomplete-patch re-exploit of CVE-2026-21510 and chains with CVE-2026-21513 in the operational APT28 toolkit. Nation-state tradecraft; no AI-tool credit on either the discovery or weaponization side. Source: https://www.helpnetsecurity.com/2026/04/29/windows-cve-2026-32202-exploited/ and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202.",
+    "_editorial_promoted": "2026-05-15",
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
   },
   "CVE-2026-33825": {
-    "_draft": true,
-    "_auto_imported": true,
     "name": "BlueHammer — Microsoft Defender File-Remediation TOCTOU LPE",
     "type": "race-condition",
     "cvss_score": 7.8,
@@ -3440,6 +3438,8 @@
       ]
     },
     "last_updated": "2026-05-15",
-    "discovery_attribution_note": "Picus Security ('BlueHammer' / RedSun research) published a working PoC before Microsoft released the patch — true zero-day disclosure 2026-04-22; CISA KEV listed same day with a 14-day due date. No AI-tool credit on the discovery; conventional Windows-Defender internals research. Source: https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained and https://www.cisa.gov/known-exploited-vulnerabilities-catalog."
+    "discovery_attribution_note": "Picus Security ('BlueHammer' / RedSun research) published a working PoC before Microsoft released the patch — true zero-day disclosure 2026-04-22; CISA KEV listed same day with a 14-day due date. No AI-tool credit on the discovery; conventional Windows-Defender internals research. Source: https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained and https://www.cisa.gov/known-exploited-vulnerabilities-catalog.",
+    "_editorial_promoted": "2026-05-15",
+    "_editorial_note": "Promoted from draft v0.12.32 (cycle 12 F1 fix): cycle 11 audit confirmed all required fields populated (iocs, vendor_advisories, verification_sources, complexity, affected_versions); RWEP factors satisfy Shape B invariant; discovery_attribution_note cites a researcher / team with URL. Editorial gate: passed."
   }
 }

package/data/cwe-catalog.json

@@ -46,7 +46,9 @@
     "skills_referencing": [
       "fuzz-testing-strategy"
     ],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-6973"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
       "ISO-27001-2022-A.8.28",
@@ -112,8 +114,8 @@
       "webapp-security"
     ],
     "evidence_cves": [
-      "MAL-2026-3083",
-      "CVE-2025-53773"
+      "CVE-2025-53773",
+      "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -145,7 +147,9 @@
       "fuzz-testing-strategy",
       "webapp-security"
     ],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-39987"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
       "ISO-27001-2022-A.8.28"
@@ -177,7 +181,9 @@
       "attack-surface-pentest",
       "webapp-security"
     ],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-42897"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
       "NIST-800-53-SC-18",
@@ -271,8 +277,7 @@
       "webapp-security"
     ],
     "evidence_cves": [
-      "CVE-2025-53773",
-      "CVE-2026-30615",
+      "CVE-2026-6973",
       "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
@@ -559,7 +564,10 @@
       "sector-energy",
       "sector-telecom"
     ],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-0300",
+      "CVE-2026-39987"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-IA-2",
       "ISO-27001-2022-A.5.17"
@@ -846,7 +854,7 @@
       "mcp-agent-trust"
     ],
     "evidence_cves": [
-      "CVE-2026-30615"
+      "CVE-2026-32202"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SA-12",
@@ -905,7 +913,9 @@
       "CAPEC-39"
     ],
     "skills_referencing": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-32202"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-7",
       "NIST-800-53-SC-8(1)",
@@ -938,7 +948,9 @@
       "fuzz-testing-strategy",
       "kernel-lpe-triage"
     ],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-33825"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-16",
       "ISO-27001-2022-A.8.28"
@@ -967,10 +979,7 @@
       "fuzz-testing-strategy",
       "kernel-lpe-triage"
     ],
-    "evidence_cves": [
-      "CVE-2026-43284",
-      "CVE-2026-43500"
-    ],
+    "evidence_cves": [],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-16",
       "NIST-800-53-SI-2",
@@ -1058,9 +1067,7 @@
       "mcp-agent-trust",
       "supply-chain-integrity"
     ],
-    "evidence_cves": [
-      "CVE-2026-30615"
-    ],
+    "evidence_cves": [],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-7",
       "NIST-800-53-SA-12",
@@ -1120,7 +1127,6 @@
     ],
     "skills_referencing": [],
     "evidence_cves": [
-      "CVE-2026-45321",
       "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
@@ -1214,7 +1220,9 @@
     "skills_referencing": [
       "kernel-lpe-triage"
     ],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2026-46300"
+    ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-16",
       "ISO-27001-2022-A.8.28"
@@ -1339,8 +1347,9 @@
       "kernel-lpe-triage"
     ],
     "evidence_cves": [
-      "CVE-2026-31431",
-      "CVE-2026-43500"
+      "CVE-2026-0300",
+      "CVE-2026-43500",
+      "CVE-2026-46300"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",