@blamejs/exceptd-skills 0.13.15 → 0.13.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/AGENTS.md +5 -2
  2. package/CHANGELOG.md +42 -0
  3. package/README.md +3 -3
  4. package/data/_indexes/_meta.json +9 -9
  5. package/data/_indexes/activity-feed.json +5 -5
  6. package/data/_indexes/catalog-summaries.json +5 -5
  7. package/data/_indexes/chains.json +36194 -5006
  8. package/data/_indexes/frequency.json +50 -1
  9. package/data/attack-techniques.json +310 -1
  10. package/data/cve-catalog.json +26215 -4
  11. package/data/cwe-catalog.json +1090 -20
  12. package/data/framework-control-gaps.json +866 -2
  13. package/data/zeroday-lessons.json +10758 -0
  14. package/lib/cve-regression-watcher.js +218 -0
  15. package/lib/refresh-external.js +11 -0
  16. package/lib/source-advisories.js +162 -11
  17. package/manifest.json +44 -44
  18. package/package.json +2 -2
  19. package/sbom.cdx.json +46 -31
package/data/framework-control-gaps.json CHANGED
@@ -1213,20 +1213,262 @@
1213
1213
  "status": "open",
1214
1214
  "opened_date": "2026-03-15",
1215
1215
  "evidence_cves": [
1216
+ "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
1217
+ "CVE-2007-0671",
1218
+ "CVE-2008-0015",
1219
+ "CVE-2009-0238",
1220
+ "CVE-2009-0556",
1221
+ "CVE-2010-3765",
1222
+ "CVE-2010-3962",
1223
+ "CVE-2011-3402",
1224
+ "CVE-2012-1854",
1225
+ "CVE-2013-3893",
1226
+ "CVE-2013-3918",
1227
+ "CVE-2014-3931",
1228
+ "CVE-2014-6278",
1229
+ "CVE-2015-7755",
1230
+ "CVE-2016-10033",
1231
+ "CVE-2016-7836",
1232
+ "CVE-2017-1000353",
1233
+ "CVE-2017-7921",
1234
+ "CVE-2018-14634",
1235
+ "CVE-2018-4063",
1236
+ "CVE-2019-19006",
1237
+ "CVE-2019-5418",
1238
+ "CVE-2019-6693",
1239
+ "CVE-2019-9621",
1240
+ "CVE-2020-17103-REREGRESSION-2026",
1241
+ "CVE-2020-24363",
1242
+ "CVE-2020-25078",
1243
+ "CVE-2020-25079",
1244
+ "CVE-2020-7796",
1245
+ "CVE-2020-9715",
1246
+ "CVE-2021-21311",
1247
+ "CVE-2021-22054",
1248
+ "CVE-2021-22175",
1249
+ "CVE-2021-22555",
1250
+ "CVE-2021-22681",
1251
+ "CVE-2021-26828",
1252
+ "CVE-2021-26829",
1253
+ "CVE-2021-30952",
1254
+ "CVE-2021-32030",
1255
+ "CVE-2021-39935",
1256
+ "CVE-2021-43226",
1257
+ "CVE-2021-43798",
1258
+ "CVE-2022-20775",
1259
+ "CVE-2022-37055",
1260
+ "CVE-2022-40799",
1261
+ "CVE-2022-48503",
1262
+ "CVE-2023-0386",
1263
+ "CVE-2023-21529",
1264
+ "CVE-2023-2533",
1265
+ "CVE-2023-27351",
1266
+ "CVE-2023-33538",
1267
+ "CVE-2023-36424",
1268
+ "CVE-2023-38950",
1269
+ "CVE-2023-39780",
1270
+ "CVE-2023-41974",
1271
+ "CVE-2023-43000",
1272
+ "CVE-2023-50224",
1273
+ "CVE-2023-52163",
1274
+ "CVE-2024-0769",
1275
+ "CVE-2024-11182",
1276
+ "CVE-2024-12987",
1277
+ "CVE-2024-1708",
1216
1278
  "CVE-2024-21762",
1279
+ "CVE-2024-27199",
1280
+ "CVE-2024-27443",
1281
+ "CVE-2024-37079",
1282
+ "CVE-2024-42009",
1283
+ "CVE-2024-43468",
1284
+ "CVE-2024-54085",
1285
+ "CVE-2024-56145",
1286
+ "CVE-2024-57726",
1287
+ "CVE-2024-57728",
1288
+ "CVE-2024-7399",
1289
+ "CVE-2024-7694",
1290
+ "CVE-2024-8068",
1291
+ "CVE-2024-8069",
1292
+ "CVE-2025-10035",
1217
1293
  "CVE-2025-10585",
1294
+ "CVE-2025-11371",
1295
+ "CVE-2025-11953",
1296
+ "CVE-2025-12480",
1297
+ "CVE-2025-13223",
1218
1298
  "CVE-2025-14174",
1299
+ "CVE-2025-14611",
1300
+ "CVE-2025-14733",
1301
+ "CVE-2025-15556",
1302
+ "CVE-2025-20281",
1303
+ "CVE-2025-20333",
1304
+ "CVE-2025-20337",
1305
+ "CVE-2025-20352",
1306
+ "CVE-2025-20362",
1307
+ "CVE-2025-20393",
1308
+ "CVE-2025-21042",
1309
+ "CVE-2025-21043",
1310
+ "CVE-2025-21479",
1311
+ "CVE-2025-21480",
1312
+ "CVE-2025-24016",
1219
1313
  "CVE-2025-24201",
1314
+ "CVE-2025-24893",
1315
+ "CVE-2025-24990",
1316
+ "CVE-2025-25257",
1317
+ "CVE-2025-26399",
1318
+ "CVE-2025-27038",
1319
+ "CVE-2025-2746",
1320
+ "CVE-2025-2747",
1321
+ "CVE-2025-2749",
1322
+ "CVE-2025-2775",
1323
+ "CVE-2025-2776",
1324
+ "CVE-2025-27915",
1325
+ "CVE-2025-27920",
1326
+ "CVE-2025-29635",
1327
+ "CVE-2025-30397",
1328
+ "CVE-2025-31125",
1329
+ "CVE-2025-31277",
1330
+ "CVE-2025-32432",
1331
+ "CVE-2025-32433",
1332
+ "CVE-2025-32463",
1333
+ "CVE-2025-32701",
1334
+ "CVE-2025-32706",
1335
+ "CVE-2025-32709",
1336
+ "CVE-2025-32756",
1337
+ "CVE-2025-32975",
1338
+ "CVE-2025-33053",
1339
+ "CVE-2025-33073",
1340
+ "CVE-2025-34026",
1341
+ "CVE-2025-35939",
1342
+ "CVE-2025-37164",
1220
1343
  "CVE-2025-38352",
1344
+ "CVE-2025-3935",
1345
+ "CVE-2025-4008",
1346
+ "CVE-2025-40536",
1347
+ "CVE-2025-40551",
1348
+ "CVE-2025-40602",
1349
+ "CVE-2025-41244",
1350
+ "CVE-2025-42999",
1351
+ "CVE-2025-43200",
1221
1352
  "CVE-2025-43300",
1353
+ "CVE-2025-43510",
1354
+ "CVE-2025-43520",
1222
1355
  "CVE-2025-43529",
1356
+ "CVE-2025-4427",
1357
+ "CVE-2025-4428",
1358
+ "CVE-2025-4632",
1359
+ "CVE-2025-47812",
1360
+ "CVE-2025-47813",
1361
+ "CVE-2025-47827",
1362
+ "CVE-2025-48384",
1363
+ "CVE-2025-48543",
1364
+ "CVE-2025-48572",
1365
+ "CVE-2025-48633",
1366
+ "CVE-2025-48700",
1367
+ "CVE-2025-48703",
1368
+ "CVE-2025-48927",
1369
+ "CVE-2025-48928",
1370
+ "CVE-2025-49113",
1223
1371
  "CVE-2025-4919",
1372
+ "CVE-2025-49704",
1373
+ "CVE-2025-49706",
1374
+ "CVE-2025-5086",
1375
+ "CVE-2025-52691",
1376
+ "CVE-2025-53521",
1377
+ "CVE-2025-53690",
1378
+ "CVE-2025-53770",
1379
+ "CVE-2025-54068",
1380
+ "CVE-2025-5419",
1381
+ "CVE-2025-54236",
1382
+ "CVE-2025-54253",
1383
+ "CVE-2025-54309",
1384
+ "CVE-2025-54313",
1385
+ "CVE-2025-54948",
1386
+ "CVE-2025-55177",
1387
+ "CVE-2025-55182",
1388
+ "CVE-2025-5777",
1389
+ "CVE-2025-57819",
1390
+ "CVE-2025-58034",
1391
+ "CVE-2025-58360",
1392
+ "CVE-2025-59230",
1393
+ "CVE-2025-59287",
1394
+ "CVE-2025-59374",
1395
+ "CVE-2025-59689",
1396
+ "CVE-2025-59718",
1397
+ "CVE-2025-60710",
1398
+ "CVE-2025-61757",
1399
+ "CVE-2025-61882",
1400
+ "CVE-2025-61884",
1401
+ "CVE-2025-61932",
1402
+ "CVE-2025-6204",
1403
+ "CVE-2025-6205",
1404
+ "CVE-2025-6218",
1405
+ "CVE-2025-62215",
1406
+ "CVE-2025-62221",
1407
+ "CVE-2025-64328",
1408
+ "CVE-2025-64446",
1409
+ "CVE-2025-6543",
1410
+ "CVE-2025-6554",
1411
+ "CVE-2025-6558",
1412
+ "CVE-2025-66376",
1413
+ "CVE-2025-66644",
1414
+ "CVE-2025-68461",
1415
+ "CVE-2025-68613",
1416
+ "CVE-2025-68645",
1417
+ "CVE-2025-7775",
1418
+ "CVE-2025-8088",
1419
+ "CVE-2025-8110",
1420
+ "CVE-2025-8875",
1421
+ "CVE-2025-8876",
1422
+ "CVE-2025-9242",
1423
+ "CVE-2025-9377",
1224
1424
  "CVE-2026-0300",
1425
+ "CVE-2026-1281",
1426
+ "CVE-2026-1340",
1427
+ "CVE-2026-1603",
1428
+ "CVE-2026-1731",
1429
+ "CVE-2026-20045",
1430
+ "CVE-2026-20122",
1431
+ "CVE-2026-20127",
1432
+ "CVE-2026-20128",
1433
+ "CVE-2026-20131",
1434
+ "CVE-2026-20133",
1435
+ "CVE-2026-20700",
1436
+ "CVE-2026-20805",
1437
+ "CVE-2026-20963",
1438
+ "CVE-2026-21385",
1439
+ "CVE-2026-21509",
1440
+ "CVE-2026-21510",
1441
+ "CVE-2026-21513",
1442
+ "CVE-2026-21514",
1443
+ "CVE-2026-21519",
1444
+ "CVE-2026-21525",
1445
+ "CVE-2026-21533",
1446
+ "CVE-2026-21643",
1447
+ "CVE-2026-22719",
1448
+ "CVE-2026-22769",
1449
+ "CVE-2026-23760",
1450
+ "CVE-2026-24061",
1451
+ "CVE-2026-2441",
1452
+ "CVE-2026-24423",
1453
+ "CVE-2026-24858",
1454
+ "CVE-2026-25108",
1455
+ "CVE-2026-3055",
1225
1456
  "CVE-2026-31431",
1226
1457
  "CVE-2026-31635",
1458
+ "CVE-2026-32201",
1459
+ "CVE-2026-33017",
1460
+ "CVE-2026-33634",
1461
+ "CVE-2026-34197",
1462
+ "CVE-2026-34621",
1463
+ "CVE-2026-3502",
1464
+ "CVE-2026-35616",
1465
+ "CVE-2026-3909",
1466
+ "CVE-2026-3910",
1467
+ "CVE-2026-41940",
1227
1468
  "CVE-2026-42945",
1228
1469
  "CVE-2026-46300",
1229
- "CVE-2026-46333"
1470
+ "CVE-2026-46333",
1471
+ "CVE-2026-5281"
1230
1472
  ],
1231
1473
  "atlas_refs": [],
1232
1474
  "attack_refs": [
@@ -1663,6 +1905,7 @@
1663
1905
  "status": "open",
1664
1906
  "opened_date": "2026-04-01",
1665
1907
  "evidence_cves": [
1908
+ "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
1666
1909
  "CVE-2025-14847",
1667
1910
  "CVE-2025-22226",
1668
1911
  "CVE-2026-43284"
@@ -1870,31 +2113,273 @@
1870
2113
  "status": "open",
1871
2114
  "opened_date": "2026-03-15",
1872
2115
  "evidence_cves": [
2116
+ "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
2117
+ "CVE-2007-0671",
2118
+ "CVE-2008-0015",
2119
+ "CVE-2009-0238",
2120
+ "CVE-2009-0556",
2121
+ "CVE-2010-3765",
2122
+ "CVE-2010-3962",
2123
+ "CVE-2011-3402",
2124
+ "CVE-2012-1854",
2125
+ "CVE-2013-3893",
2126
+ "CVE-2013-3918",
2127
+ "CVE-2014-3931",
2128
+ "CVE-2014-6278",
2129
+ "CVE-2015-7755",
2130
+ "CVE-2016-10033",
2131
+ "CVE-2016-7836",
2132
+ "CVE-2017-1000353",
2133
+ "CVE-2017-7921",
2134
+ "CVE-2018-14634",
2135
+ "CVE-2018-4063",
2136
+ "CVE-2019-19006",
2137
+ "CVE-2019-5418",
2138
+ "CVE-2019-6693",
2139
+ "CVE-2019-9621",
2140
+ "CVE-2020-17103-REREGRESSION-2026",
2141
+ "CVE-2020-24363",
2142
+ "CVE-2020-25078",
2143
+ "CVE-2020-25079",
2144
+ "CVE-2020-7796",
2145
+ "CVE-2020-9715",
2146
+ "CVE-2021-21311",
2147
+ "CVE-2021-22054",
2148
+ "CVE-2021-22175",
2149
+ "CVE-2021-22555",
2150
+ "CVE-2021-22681",
2151
+ "CVE-2021-26828",
2152
+ "CVE-2021-26829",
2153
+ "CVE-2021-30952",
2154
+ "CVE-2021-32030",
2155
+ "CVE-2021-39935",
2156
+ "CVE-2021-43226",
2157
+ "CVE-2021-43798",
2158
+ "CVE-2022-20775",
2159
+ "CVE-2022-37055",
2160
+ "CVE-2022-40799",
2161
+ "CVE-2022-48503",
2162
+ "CVE-2023-0386",
2163
+ "CVE-2023-21529",
2164
+ "CVE-2023-2533",
2165
+ "CVE-2023-27351",
2166
+ "CVE-2023-33538",
1873
2167
  "CVE-2023-3519",
2168
+ "CVE-2023-36424",
2169
+ "CVE-2023-38950",
2170
+ "CVE-2023-39780",
2171
+ "CVE-2023-41974",
2172
+ "CVE-2023-43000",
2173
+ "CVE-2023-50224",
2174
+ "CVE-2023-52163",
2175
+ "CVE-2024-0769",
2176
+ "CVE-2024-11182",
2177
+ "CVE-2024-12987",
2178
+ "CVE-2024-1708",
1874
2179
  "CVE-2024-21762",
2180
+ "CVE-2024-27199",
2181
+ "CVE-2024-27443",
2182
+ "CVE-2024-37079",
2183
+ "CVE-2024-42009",
2184
+ "CVE-2024-43468",
2185
+ "CVE-2024-54085",
2186
+ "CVE-2024-56145",
2187
+ "CVE-2024-57726",
2188
+ "CVE-2024-57728",
2189
+ "CVE-2024-7399",
2190
+ "CVE-2024-7694",
2191
+ "CVE-2024-8068",
2192
+ "CVE-2024-8069",
2193
+ "CVE-2025-10035",
1875
2194
  "CVE-2025-10585",
2195
+ "CVE-2025-11371",
2196
+ "CVE-2025-11953",
2197
+ "CVE-2025-12480",
1876
2198
  "CVE-2025-12686",
2199
+ "CVE-2025-13223",
1877
2200
  "CVE-2025-14174",
2201
+ "CVE-2025-14611",
2202
+ "CVE-2025-14733",
2203
+ "CVE-2025-15556",
2204
+ "CVE-2025-20281",
2205
+ "CVE-2025-20333",
2206
+ "CVE-2025-20337",
2207
+ "CVE-2025-20352",
2208
+ "CVE-2025-20362",
2209
+ "CVE-2025-20393",
2210
+ "CVE-2025-21042",
2211
+ "CVE-2025-21043",
2212
+ "CVE-2025-21479",
2213
+ "CVE-2025-21480",
2214
+ "CVE-2025-24016",
1878
2215
  "CVE-2025-24201",
2216
+ "CVE-2025-24893",
2217
+ "CVE-2025-24990",
2218
+ "CVE-2025-25257",
2219
+ "CVE-2025-26399",
2220
+ "CVE-2025-27038",
2221
+ "CVE-2025-2746",
2222
+ "CVE-2025-2747",
2223
+ "CVE-2025-2749",
2224
+ "CVE-2025-2775",
2225
+ "CVE-2025-2776",
2226
+ "CVE-2025-27915",
2227
+ "CVE-2025-27920",
2228
+ "CVE-2025-29635",
2229
+ "CVE-2025-30397",
2230
+ "CVE-2025-31125",
2231
+ "CVE-2025-31277",
2232
+ "CVE-2025-32432",
2233
+ "CVE-2025-32433",
2234
+ "CVE-2025-32463",
2235
+ "CVE-2025-32701",
2236
+ "CVE-2025-32706",
2237
+ "CVE-2025-32709",
2238
+ "CVE-2025-32756",
2239
+ "CVE-2025-32975",
2240
+ "CVE-2025-33053",
2241
+ "CVE-2025-33073",
2242
+ "CVE-2025-34026",
2243
+ "CVE-2025-35939",
2244
+ "CVE-2025-37164",
1879
2245
  "CVE-2025-38352",
2246
+ "CVE-2025-3935",
2247
+ "CVE-2025-4008",
2248
+ "CVE-2025-40536",
2249
+ "CVE-2025-40551",
2250
+ "CVE-2025-40602",
2251
+ "CVE-2025-41244",
2252
+ "CVE-2025-42999",
2253
+ "CVE-2025-43200",
1880
2254
  "CVE-2025-43300",
2255
+ "CVE-2025-43510",
2256
+ "CVE-2025-43520",
1881
2257
  "CVE-2025-43529",
2258
+ "CVE-2025-4427",
2259
+ "CVE-2025-4428",
2260
+ "CVE-2025-4632",
2261
+ "CVE-2025-47812",
2262
+ "CVE-2025-47813",
2263
+ "CVE-2025-47827",
2264
+ "CVE-2025-48384",
2265
+ "CVE-2025-48543",
2266
+ "CVE-2025-48572",
2267
+ "CVE-2025-48633",
2268
+ "CVE-2025-48700",
2269
+ "CVE-2025-48703",
2270
+ "CVE-2025-48927",
2271
+ "CVE-2025-48928",
2272
+ "CVE-2025-49113",
1882
2273
  "CVE-2025-4919",
2274
+ "CVE-2025-49704",
2275
+ "CVE-2025-49706",
2276
+ "CVE-2025-5086",
2277
+ "CVE-2025-52691",
2278
+ "CVE-2025-53521",
2279
+ "CVE-2025-53690",
2280
+ "CVE-2025-53770",
2281
+ "CVE-2025-54068",
2282
+ "CVE-2025-5419",
2283
+ "CVE-2025-54236",
2284
+ "CVE-2025-54253",
2285
+ "CVE-2025-54309",
2286
+ "CVE-2025-54313",
2287
+ "CVE-2025-54948",
2288
+ "CVE-2025-55177",
2289
+ "CVE-2025-55182",
2290
+ "CVE-2025-5777",
2291
+ "CVE-2025-57819",
2292
+ "CVE-2025-58034",
2293
+ "CVE-2025-58360",
2294
+ "CVE-2025-59230",
2295
+ "CVE-2025-59287",
2296
+ "CVE-2025-59374",
1883
2297
  "CVE-2025-59389",
2298
+ "CVE-2025-59689",
2299
+ "CVE-2025-59718",
2300
+ "CVE-2025-60710",
2301
+ "CVE-2025-61757",
2302
+ "CVE-2025-61882",
2303
+ "CVE-2025-61884",
2304
+ "CVE-2025-61932",
2305
+ "CVE-2025-6204",
2306
+ "CVE-2025-6205",
2307
+ "CVE-2025-6218",
2308
+ "CVE-2025-62215",
2309
+ "CVE-2025-62221",
1884
2310
  "CVE-2025-62847",
1885
2311
  "CVE-2025-62848",
1886
2312
  "CVE-2025-62849",
2313
+ "CVE-2025-64328",
2314
+ "CVE-2025-64446",
2315
+ "CVE-2025-6543",
2316
+ "CVE-2025-6554",
2317
+ "CVE-2025-6558",
2318
+ "CVE-2025-66376",
2319
+ "CVE-2025-66644",
2320
+ "CVE-2025-68461",
2321
+ "CVE-2025-68613",
2322
+ "CVE-2025-68645",
2323
+ "CVE-2025-7775",
2324
+ "CVE-2025-8088",
2325
+ "CVE-2025-8110",
2326
+ "CVE-2025-8875",
2327
+ "CVE-2025-8876",
2328
+ "CVE-2025-9242",
2329
+ "CVE-2025-9377",
1887
2330
  "CVE-2026-0300",
2331
+ "CVE-2026-1281",
2332
+ "CVE-2026-1340",
2333
+ "CVE-2026-1603",
2334
+ "CVE-2026-1731",
2335
+ "CVE-2026-20045",
2336
+ "CVE-2026-20122",
2337
+ "CVE-2026-20127",
2338
+ "CVE-2026-20128",
2339
+ "CVE-2026-20131",
2340
+ "CVE-2026-20133",
2341
+ "CVE-2026-20700",
2342
+ "CVE-2026-20805",
2343
+ "CVE-2026-20963",
2344
+ "CVE-2026-21385",
2345
+ "CVE-2026-21509",
2346
+ "CVE-2026-21510",
2347
+ "CVE-2026-21513",
2348
+ "CVE-2026-21514",
2349
+ "CVE-2026-21519",
2350
+ "CVE-2026-21525",
2351
+ "CVE-2026-21533",
2352
+ "CVE-2026-21643",
2353
+ "CVE-2026-22719",
2354
+ "CVE-2026-22769",
2355
+ "CVE-2026-23760",
2356
+ "CVE-2026-24061",
2357
+ "CVE-2026-2441",
2358
+ "CVE-2026-24423",
2359
+ "CVE-2026-24858",
2360
+ "CVE-2026-25108",
2361
+ "CVE-2026-3055",
1888
2362
  "CVE-2026-31431",
1889
2363
  "CVE-2026-31635",
2364
+ "CVE-2026-32201",
1890
2365
  "CVE-2026-32202",
2366
+ "CVE-2026-33017",
2367
+ "CVE-2026-33634",
1891
2368
  "CVE-2026-33825",
2369
+ "CVE-2026-34197",
2370
+ "CVE-2026-34621",
2371
+ "CVE-2026-3502",
2372
+ "CVE-2026-35616",
2373
+ "CVE-2026-3909",
2374
+ "CVE-2026-3910",
2375
+ "CVE-2026-41940",
1892
2376
  "CVE-2026-42897",
1893
2377
  "CVE-2026-42945",
1894
2378
  "CVE-2026-43284",
1895
2379
  "CVE-2026-43500",
1896
2380
  "CVE-2026-46300",
1897
2381
  "CVE-2026-46333",
2382
+ "CVE-2026-5281",
1898
2383
  "CVE-2026-6973"
1899
2384
  ],
1900
2385
  "atlas_refs": [],
@@ -1926,6 +2411,7 @@
1926
2411
  "status": "open",
1927
2412
  "opened_date": "2026-02-01",
1928
2413
  "evidence_cves": [
2414
+ "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
1929
2415
  "CVE-2025-11837",
1930
2416
  "CVE-2026-22778",
1931
2417
  "CVE-2026-32202",
@@ -4141,9 +4627,187 @@
4141
4627
  "status": "open",
4142
4628
  "opened_date": "2026-05-15",
4143
4629
  "evidence_cves": [
4630
+ "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
4631
+ "CVE-2007-0671",
4632
+ "CVE-2008-0015",
4633
+ "CVE-2009-0238",
4634
+ "CVE-2009-0556",
4635
+ "CVE-2010-3765",
4636
+ "CVE-2010-3962",
4637
+ "CVE-2011-3402",
4638
+ "CVE-2012-1854",
4639
+ "CVE-2013-3893",
4640
+ "CVE-2013-3918",
4641
+ "CVE-2014-6278",
4642
+ "CVE-2015-7755",
4643
+ "CVE-2016-10033",
4644
+ "CVE-2016-7836",
4645
+ "CVE-2017-1000353",
4646
+ "CVE-2017-7921",
4647
+ "CVE-2018-4063",
4648
+ "CVE-2019-19006",
4649
+ "CVE-2019-6693",
4650
+ "CVE-2020-24363",
4651
+ "CVE-2020-25078",
4652
+ "CVE-2020-25079",
4653
+ "CVE-2021-22681",
4654
+ "CVE-2021-26828",
4655
+ "CVE-2021-32030",
4656
+ "CVE-2022-37055",
4657
+ "CVE-2022-40799",
4658
+ "CVE-2022-48503",
4659
+ "CVE-2023-0386",
4660
+ "CVE-2023-21529",
4661
+ "CVE-2023-2533",
4662
+ "CVE-2023-27351",
4663
+ "CVE-2023-33538",
4664
+ "CVE-2023-39780",
4665
+ "CVE-2023-50224",
4666
+ "CVE-2023-52163",
4667
+ "CVE-2024-12987",
4668
+ "CVE-2024-37079",
4669
+ "CVE-2024-43468",
4670
+ "CVE-2024-54085",
4671
+ "CVE-2024-56145",
4672
+ "CVE-2024-57726",
4673
+ "CVE-2024-7694",
4674
+ "CVE-2024-8069",
4675
+ "CVE-2025-10035",
4144
4676
  "CVE-2025-10725",
4677
+ "CVE-2025-11371",
4678
+ "CVE-2025-11953",
4679
+ "CVE-2025-12480",
4680
+ "CVE-2025-13223",
4681
+ "CVE-2025-14611",
4682
+ "CVE-2025-14733",
4683
+ "CVE-2025-15556",
4684
+ "CVE-2025-20281",
4685
+ "CVE-2025-20333",
4686
+ "CVE-2025-20337",
4687
+ "CVE-2025-20352",
4688
+ "CVE-2025-20362",
4689
+ "CVE-2025-20393",
4690
+ "CVE-2025-21042",
4691
+ "CVE-2025-21043",
4692
+ "CVE-2025-24016",
4693
+ "CVE-2025-24893",
4694
+ "CVE-2025-25257",
4695
+ "CVE-2025-26399",
4696
+ "CVE-2025-2746",
4697
+ "CVE-2025-2747",
4698
+ "CVE-2025-2775",
4699
+ "CVE-2025-2776",
4700
+ "CVE-2025-29635",
4701
+ "CVE-2025-30397",
4702
+ "CVE-2025-31125",
4703
+ "CVE-2025-32432",
4704
+ "CVE-2025-32433",
4705
+ "CVE-2025-32463",
4706
+ "CVE-2025-32706",
4707
+ "CVE-2025-32756",
4708
+ "CVE-2025-32975",
4709
+ "CVE-2025-33053",
4710
+ "CVE-2025-33073",
4711
+ "CVE-2025-34026",
4712
+ "CVE-2025-35939",
4713
+ "CVE-2025-37164",
4714
+ "CVE-2025-3935",
4715
+ "CVE-2025-4008",
4716
+ "CVE-2025-40536",
4717
+ "CVE-2025-40551",
4718
+ "CVE-2025-41244",
4719
+ "CVE-2025-42999",
4720
+ "CVE-2025-43200",
4721
+ "CVE-2025-43510",
4722
+ "CVE-2025-43520",
4723
+ "CVE-2025-4427",
4724
+ "CVE-2025-4428",
4725
+ "CVE-2025-47812",
4726
+ "CVE-2025-47827",
4727
+ "CVE-2025-48384",
4728
+ "CVE-2025-48703",
4729
+ "CVE-2025-48927",
4730
+ "CVE-2025-48928",
4731
+ "CVE-2025-49113",
4732
+ "CVE-2025-49704",
4733
+ "CVE-2025-49706",
4734
+ "CVE-2025-5086",
4735
+ "CVE-2025-52691",
4736
+ "CVE-2025-53521",
4737
+ "CVE-2025-53690",
4738
+ "CVE-2025-53770",
4739
+ "CVE-2025-54068",
4740
+ "CVE-2025-54236",
4741
+ "CVE-2025-54253",
4742
+ "CVE-2025-54309",
4743
+ "CVE-2025-54313",
4744
+ "CVE-2025-54948",
4745
+ "CVE-2025-55177",
4746
+ "CVE-2025-55182",
4145
4747
  "CVE-2025-55241",
4748
+ "CVE-2025-57819",
4749
+ "CVE-2025-58034",
4750
+ "CVE-2025-58360",
4751
+ "CVE-2025-59230",
4752
+ "CVE-2025-59287",
4753
+ "CVE-2025-59374",
4754
+ "CVE-2025-59689",
4755
+ "CVE-2025-59718",
4756
+ "CVE-2025-61757",
4757
+ "CVE-2025-61882",
4758
+ "CVE-2025-61932",
4759
+ "CVE-2025-6204",
4760
+ "CVE-2025-6205",
4761
+ "CVE-2025-62221",
4762
+ "CVE-2025-64328",
4763
+ "CVE-2025-6554",
4764
+ "CVE-2025-6558",
4765
+ "CVE-2025-66644",
4766
+ "CVE-2025-68613",
4767
+ "CVE-2025-68645",
4768
+ "CVE-2025-7775",
4769
+ "CVE-2025-8875",
4770
+ "CVE-2025-8876",
4771
+ "CVE-2025-9242",
4772
+ "CVE-2025-9377",
4773
+ "CVE-2026-1281",
4774
+ "CVE-2026-1340",
4775
+ "CVE-2026-1603",
4776
+ "CVE-2026-1731",
4777
+ "CVE-2026-20045",
4778
+ "CVE-2026-20122",
4779
+ "CVE-2026-20127",
4780
+ "CVE-2026-20128",
4781
+ "CVE-2026-20131",
4782
+ "CVE-2026-20133",
4783
+ "CVE-2026-20700",
4784
+ "CVE-2026-20963",
4785
+ "CVE-2026-21509",
4786
+ "CVE-2026-21510",
4787
+ "CVE-2026-21513",
4788
+ "CVE-2026-21514",
4789
+ "CVE-2026-21519",
4790
+ "CVE-2026-21525",
4791
+ "CVE-2026-21533",
4792
+ "CVE-2026-21643",
4793
+ "CVE-2026-22719",
4794
+ "CVE-2026-22769",
4795
+ "CVE-2026-23760",
4796
+ "CVE-2026-24061",
4797
+ "CVE-2026-24423",
4798
+ "CVE-2026-24858",
4799
+ "CVE-2026-25108",
4800
+ "CVE-2026-32201",
4801
+ "CVE-2026-33017",
4802
+ "CVE-2026-33634",
4146
4803
  "CVE-2026-33825",
4804
+ "CVE-2026-34197",
4805
+ "CVE-2026-34621",
4806
+ "CVE-2026-3502",
4807
+ "CVE-2026-35616",
4808
+ "CVE-2026-3909",
4809
+ "CVE-2026-3910",
4810
+ "CVE-2026-41940",
4147
4811
  "CVE-2026-6973"
4148
4812
  ],
4149
4813
  "atlas_refs": [],
@@ -4210,6 +4874,7 @@
4210
4874
  "status": "open",
4211
4875
  "opened_date": "2026-05-15",
4212
4876
  "evidence_cves": [
4877
+ "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
4213
4878
  "CVE-2025-11837",
4214
4879
  "CVE-2026-32202",
4215
4880
  "CVE-2026-33825",
@@ -4280,8 +4945,30 @@
4280
4945
  "status": "open",
4281
4946
  "opened_date": "2026-05-15",
4282
4947
  "evidence_cves": [
4948
+ "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
4949
+ "CVE-2019-6693",
4950
+ "CVE-2023-21529",
4951
+ "CVE-2023-27351",
4952
+ "CVE-2024-1708",
4953
+ "CVE-2024-27199",
4954
+ "CVE-2024-57726",
4955
+ "CVE-2024-57728",
4956
+ "CVE-2025-10035",
4957
+ "CVE-2025-49704",
4958
+ "CVE-2025-49706",
4959
+ "CVE-2025-52691",
4960
+ "CVE-2025-53770",
4961
+ "CVE-2025-55182",
4962
+ "CVE-2025-5777",
4963
+ "CVE-2025-61882",
4964
+ "CVE-2025-61884",
4965
+ "CVE-2026-1731",
4966
+ "CVE-2026-20131",
4967
+ "CVE-2026-23760",
4968
+ "CVE-2026-24423",
4283
4969
  "CVE-2026-32202",
4284
- "CVE-2026-33825"
4970
+ "CVE-2026-33825",
4971
+ "CVE-2026-41940"
4285
4972
  ],
4286
4973
  "atlas_refs": [],
4287
4974
  "attack_refs": [
@@ -5181,6 +5868,7 @@
5181
5868
  "status": "open",
5182
5869
  "opened_at": "2026-05-18",
5183
5870
  "evidence_cves": [
5871
+ "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
5184
5872
  "CVE-2025-14847"
5185
5873
  ],
5186
5874
  "theater_test": {
@@ -6051,5 +6739,181 @@
6051
6739
  ],
6052
6740
  "verdict_when_failed": "compliance-theater"
6053
6741
  }
6742
+ },
6743
+ "NIST-800-53-CM-3": {
6744
+ "framework": "NIST SP 800-53 Rev 5",
6745
+ "control_id": "CM-3",
6746
+ "control_name": "Configuration Change Control",
6747
+ "designed_for": "Operator-driven configuration changes — formal review, test, approval, and documentation of configuration modifications under the organization's CM program. Anticipates regressions arising from operator action.",
6748
+ "misses": [
6749
+ "Silent vendor regression of previously-fixed CVEs where the vendor reintroduces a defect into shipping product without operator action or notification (MiniPlasma class — CVE-2020-17103 reverted into 2026 Patch Tuesday cumulative builds with no advisory)",
6750
+ "Change-control assumes regressions are detectable via the operator's own change-management process; vendor-side regressions appear as a clean install that nonetheless restores a previously-fixed primitive",
6751
+ "No surfacing mechanism for the 'fix-shipped-then-silently-reverted' state"
6752
+ ],
6753
+ "real_requirement": "Pair CM-3 with a CVE-regression-watcher (NEW-CTRL-074) that cross-checks researcher PoC announcements against the historical CVE catalog. When a researcher republishes a working PoC against an old CVE ID, flag for triage even when the vendor declines to issue a new ID.",
6754
+ "status": "open",
6755
+ "opened_date": "2026-05-18",
6756
+ "evidence_cves": [
6757
+ "CVE-2020-17103-REREGRESSION-2026"
6758
+ ],
6759
+ "theater_test": {
6760
+ "claim": "Configuration-change control prevents unauthorized configuration drift per NIST 800-53 CM-3.",
6761
+ "test": "Pull the configuration-change-control evidence pack. Confirm the change-management process names 'silent vendor regression of previously-fixed CVE' as a tracked change class. Test: subscribe to the CVE-regression-watcher (NEW-CTRL-074) output for a single audit cycle and confirm at least one historical-CVE candidate is triaged. Theater verdict if CM-3 evidence references only operator-driven changes with no mechanism for surfacing vendor-side regressions.",
6762
+ "evidence_required": [
6763
+ "CM-3 process document",
6764
+ "CVE-regression-watcher integration with change-control intake",
6765
+ "triage log showing at least one historical-CVE candidate evaluation"
6766
+ ],
6767
+ "verdict_when_failed": "compliance-theater"
6768
+ }
6769
+ },
6770
+ "NIST-800-53-MP-7": {
6771
+ "framework": "NIST SP 800-53 Rev 5",
6772
+ "control_id": "MP-7",
6773
+ "control_name": "Media Use",
6774
+ "designed_for": "Restricting and monitoring use of removable media (USB drives, optical media, external hard drives) on organizational systems. Treats encryption-at-rest as the primary technical control for stolen-device confidentiality.",
6775
+ "misses": [
6776
+ "BitLocker TPM-only protector bypasses (YellowKey class) — the default Windows BitLocker configuration unseals the VMK based on platform-state attestation alone, with no user-authentication component, so a boot-flow bypass can inherit the unsealed key without ever proving identity",
6777
+ "MP-7 silently passes for organizations relying on default BitLocker configurations because 'encryption is enabled' is the audit check, not 'encryption authentication is bound to the user'"
6778
+ ],
6779
+ "real_requirement": "Enforce TPM+PIN protector via GPO ('Require additional authentication at startup' → 'Allow startup PIN with TPM') so the unsealing step requires user-supplied PIN that a boot-flow bypass cannot inherit. Track configuration via Intune compliance / SCCM inventory and alert on regressions to TPM-only.",
6780
+ "status": "open",
6781
+ "opened_date": "2026-05-18",
6782
+ "evidence_cves": [
6783
+ "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY"
6784
+ ],
6785
+ "theater_test": {
6786
+ "claim": "Storage-media confidentiality controls defeat stolen-device confidentiality breach per NIST 800-53 MP-7.",
6787
+ "test": "Sample 20 in-scope laptops and pull manage-bde -status. Confirm 'Key Protectors' lists TPM AND PIN (or TPM AND USB key, or Numerical Password as recovery). Theater verdict if the sample is dominated by TPM-only protector and the audit treats 'BitLocker enabled' as sufficient evidence without examining protector class.",
6788
+ "evidence_required": [
6789
+ "MP-7 BitLocker configuration policy",
6790
+ "Intune / SCCM compliance report showing protector-class distribution",
6791
+ "GPO 'Require additional authentication at startup' setting"
6792
+ ],
6793
+ "verdict_when_failed": "compliance-theater"
6794
+ }
6795
+ },
6796
+ "ISO-27001-2022-A.7.10": {
6797
+ "framework": "ISO/IEC 27001:2022",
6798
+ "control_id": "A.7.10",
6799
+ "control_name": "Storage media",
6800
+ "designed_for": "Storage-media handling controls; treats full-disk encryption as the technical safeguard against device-loss confidentiality breach.",
6801
+ "misses": [
6802
+ "Default Windows BitLocker TPM-only protector silently violates the A.7.10 storage-media confidentiality assumption when a boot-flow bypass (YellowKey class) inherits the TPM-unsealed VMK without authentication"
6803
+ ],
6804
+ "real_requirement": "TPM+PIN BitLocker protector or equivalent strong pre-boot authentication; audit compliance via independent control-plane (Intune / SCCM), not local Get-BitLockerVolume output (which reports 'enabled' regardless of protector class).",
6805
+ "status": "open",
6806
+ "opened_date": "2026-05-18",
6807
+ "evidence_cves": [
6808
+ "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY"
6809
+ ],
6810
+ "theater_test": {
6811
+ "claim": "Storage-media controls protect data confidentiality per ISO/IEC 27001:2022 A.7.10.",
6812
+ "test": "Same evidence-shape as NIST-800-53-MP-7. Confirm BitLocker protector class is documented per device class. Theater verdict if the SoA (Statement of Applicability) cites 'full-disk encryption' without naming the protector class that binds the key to user authentication.",
6813
+ "evidence_required": [
6814
+ "A.7.10 SoA entry",
6815
+ "device-class encryption-protector matrix",
6816
+ "evidence of independent verification (not just local Get-BitLockerVolume)"
6817
+ ],
6818
+ "verdict_when_failed": "compliance-theater"
6819
+ }
6820
+ },
6821
+ "EU-GDPR-Art.32-1(a)": {
6822
+ "framework": "EU GDPR",
6823
+ "control_id": "Art.32(1)(a)",
6824
+ "control_name": "Pseudonymisation and encryption of personal data",
6825
+ "designed_for": "Article 32 lists pseudonymisation + encryption as appropriate technical and organisational measures for personal-data protection. Encryption-at-rest is the canonical implementation for stolen-device scenarios.",
6826
+ "misses": [
6827
+ "If the default Windows BitLocker posture is breakable by a thief with physical access (YellowKey class), organisations relying on encryption-at-rest as their GDPR Art.32 control face an open-finding state without realising it — the disk reports encrypted, but the encryption does not defeat the threat the control was meant to mitigate"
6828
+ ],
6829
+ "real_requirement": "Document the BitLocker protector class (TPM-only vs TPM+PIN) in the Art.32 evidence pack. TPM-only without compensating controls is insufficient for personal-data confidentiality on portable devices; bind the encryption to user authentication.",
6830
+ "status": "open",
6831
+ "opened_date": "2026-05-18",
6832
+ "evidence_cves": [
6833
+ "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY"
6834
+ ],
6835
+ "theater_test": {
6836
+ "claim": "Encryption-at-rest is an appropriate technical measure for personal-data protection per GDPR Art.32(1)(a).",
6837
+ "test": "Pull the Art.32 technical-measure documentation. Confirm it names the protector class for any BitLocker / FileVault / LUKS deployment used to safeguard personal data on portable devices. Theater verdict if the documentation cites 'devices are encrypted' without documenting protector class or pre-boot authentication binding.",
6838
+ "evidence_required": [
6839
+ "Art.32 technical-measure register",
6840
+ "device-class protector inventory",
6841
+ "evidence that encryption is bound to user authentication (TPM+PIN or equivalent)"
6842
+ ],
6843
+ "verdict_when_failed": "compliance-theater"
6844
+ }
6845
+ },
6846
+ "NIS2-Art21-vulnerability-handling": {
6847
+ "framework": "EU NIS2 Directive",
6848
+ "control_id": "Art.21",
6849
+ "control_name": "Cybersecurity risk-management measures (vulnerability handling and disclosure)",
6850
+ "designed_for": "NIS2 vulnerability handling assumes forward-only vulnerability flow — disclose, patch, notify per the directive's timelines.",
6851
+ "misses": [
6852
+ "Historical CVE silently re-broken in current shipping product (MiniPlasma — CVE-2020-17103 re-regressed without new ID) has no NIS2 notification trigger until re-disclosed under a new ID. Essential / Important entities receive no advisory channel for the 'silent regression of fixed CVE' class.",
6853
+ "The 24-hour early-warning + 72-hour incident-notification clocks anchor on vendor disclosure, not on researcher PoC publication against an unpatched primitive"
6854
+ ],
6855
+ "real_requirement": "Treat researcher PoC publication against a historical CVE that demonstrably reproduces on current product as a Significant Incident under Art.23(4) — the regression watcher (NEW-CTRL-074) provides the surfacing channel.",
6856
+ "status": "open",
6857
+ "opened_date": "2026-05-18",
6858
+ "evidence_cves": [
6859
+ "CVE-2019-6693",
6860
+ "CVE-2020-17103-REREGRESSION-2026",
6861
+ "CVE-2023-21529",
6862
+ "CVE-2023-27351",
6863
+ "CVE-2024-1708",
6864
+ "CVE-2024-27199",
6865
+ "CVE-2024-57726",
6866
+ "CVE-2024-57728",
6867
+ "CVE-2025-10035",
6868
+ "CVE-2025-49704",
6869
+ "CVE-2025-49706",
6870
+ "CVE-2025-52691",
6871
+ "CVE-2025-53770",
6872
+ "CVE-2025-55182",
6873
+ "CVE-2025-5777",
6874
+ "CVE-2025-61882",
6875
+ "CVE-2025-61884",
6876
+ "CVE-2026-1731",
6877
+ "CVE-2026-20131",
6878
+ "CVE-2026-23760",
6879
+ "CVE-2026-24423",
6880
+ "CVE-2026-41940"
6881
+ ],
6882
+ "theater_test": {
6883
+ "claim": "Vulnerability handling and disclosure procedures align with NIS2 Art.21 obligations.",
6884
+ "test": "Confirm the vulnerability-handling SOP includes a surfacing channel for historical-CVE regression events (researcher PoC against an old CVE that reproduces on current product). Test: present a synthetic regression case (e.g. the CVE-2020-17103-REREGRESSION-2026 entry) and confirm the SOP routes it to the Art.23 incident-classification gate within 24h. Theater verdict if the SOP only triggers on new CVE IDs.",
6885
+ "evidence_required": [
6886
+ "vulnerability-handling SOP",
6887
+ "incident-classification matrix referencing regression class",
6888
+ "subscription to NEW-CTRL-074 regression-watcher output"
6889
+ ],
6890
+ "verdict_when_failed": "compliance-theater"
6891
+ }
6892
+ },
6893
+ "NIST-800-53-SI-4": {
6894
+ "framework": "NIST SP 800-53 Rev 5",
6895
+ "control_id": "SI-4",
6896
+ "control_name": "System Monitoring",
6897
+ "designed_for": "Monitoring information systems for attacks, indicators of compromise, unauthorized access, and security-control effectiveness. Assumes monitoring controls remain effective at their stated function.",
6898
+ "misses": [
6899
+ "AV / EDR agents whose update channel has been silently corrupted (UnDefend class) continue to report healthy via the agent's own status output while the protection-mechanism is degraded — SI-4 monitoring controls that check 'is Defender running?' return green while the agent is operationally blind",
6900
+ "Independent verification of monitoring-control currency is not part of the standard SI-4 control language; operators routinely rely on the agent's self-reported status"
6901
+ ],
6902
+ "real_requirement": "Cross-check AV/EDR signature + platform timestamps against an independent control plane (Defender for Endpoint cloud telemetry, Intune compliance, SCCM inventory) and alert on drift > 7 days. NEW-CTRL-075 (AV-AGENT-CURRENCY-CROSS-VERIFICATION) provides the operational pattern.",
6903
+ "status": "open",
6904
+ "opened_date": "2026-05-18",
6905
+ "evidence_cves": [
6906
+ "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND"
6907
+ ],
6908
+ "theater_test": {
6909
+ "claim": "System monitoring effectively detects compromise and security-control degradation per NIST 800-53 SI-4.",
6910
+ "test": "Pull the AV/EDR monitoring documentation. Confirm currency verification uses an independent control plane (Defender for Endpoint cloud telemetry, Intune compliance, SCCM inventory) and alerts on signature/platform drift > 7 days. Theater verdict if the only currency check is the agent's own Get-MpComputerStatus / equivalent self-report.",
6911
+ "evidence_required": [
6912
+ "SI-4 monitoring runbook",
6913
+ "independent control-plane query (cloud-telemetry / Intune / SCCM)",
6914
+ "alert configuration: signature/platform drift > 7 days"
6915
+ ],
6916
+ "verdict_when_failed": "compliance-theater"
6917
+ }
6054
6918
  }
6055
6919
  }