@blamejs/exceptd-skills 0.13.79 → 0.13.80

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.13.80 — 2026-05-25
+
+CVE catalog — ShadowRay (CVE-2023-48022). Adds Anyscale Ray's unauthenticated Job Submission / Dashboard API remote code execution, the landmark case for prioritizing on real-world exploitation rather than CVSS or KEV alone. NVD marks the CVE disputed — the vendor frames the open Job API as intended for trusted networks — so it carries no code patch and is not on the CISA KEV catalog. Yet it is exploited at scale: Oligo's ShadowRay 2.0 campaign turned roughly 230,000 internet-exposed Ray clusters into crypto-mining botnets and exfiltrated model weights and cloud credentials. It therefore scores RWEP 68 (high) on confirmed active exploitation plus broad blast radius with no patch credit. The entry maps real MITRE ATLAS techniques (AML.T0049 / T0034 / T0035 / T0025) and ATT&CK T1190 / T1059 / T1496, and its zero-day lesson names the "controlled network is a security control" theater pattern, with a control requiring the AI compute control plane to authenticate every caller (Ray token auth, no untrusted-network exposure). Mitigation is configuration, not a patch. CVE count 339 → 340.
+
 ## 0.13.79 — 2026-05-25
 
 CVE catalog — NVIDIA Triton Inference Server authentication bypass. Adds the two CWE-288 authentication-bypass CVEs from NVIDIA's May 2026 Triton bulletin: **CVE-2026-24207** and **CVE-2026-24206**, both NIST CVSS 9.8 and reachable unauthenticated over the network against one of the most widely deployed AI inference servers. A successful bypass reaches Triton's model control plane (model load/unload, repository management) without credentials. Fixed in r26.03. NVD enriched CVE-2026-24206 to 9.8 while NVIDIA scored it 7.3 — the entry stores the NVD primary and records the dispute. Their shared zero-day lesson adds a control requiring inference-server authentication to be proven complete across every request path, not assumed from the primary API. CVE count 337 → 339.

package/data/_indexes/_meta.json

@@ -1,21 +1,21 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-25T16:42:34.062Z",
+  "generated_at": "2026-05-25T17:04:07.332Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "4f7bed02332724fc70706387c682a16111eeba29020f81bdc2ec96e9844ae4fc",
-    "data/atlas-ttps.json": "07e28f5fe196d8e16082968ce36e4d33b720a024a9c00afd10ddc076a8ae8935",
-    "data/attack-techniques.json": "17d33816b3c5d8266166b2bf13e03d1404df1617e8c6d58f4af53199a1400fe6",
-    "data/cve-catalog.json": "737b00a7f6ec4f47a72c3d018a1661393e869f0e9d667715d71d948d7e92c373",
-    "data/cwe-catalog.json": "56d65a2cb3c5a2f2e354ee9e391c9cd3dbf2b1a8b308777e9ab77694710a3c76",
+    "manifest.json": "b34aa1f8554be5f81cc63b5b231a03b01163012f1a6156f44ce593225a4a0e2d",
+    "data/atlas-ttps.json": "9722cfa6587b374ab30f88dff3b81e113634ee98e95a0e5f0a99bf1fdb92db9d",
+    "data/attack-techniques.json": "517af0c37d407f58ea1834700ce89035850658c5a50dde69b4539d3de0418d77",
+    "data/cve-catalog.json": "64af054577e87060c32c2796d749614161680194fd81024a2d8c9399bf93b23c",
+    "data/cwe-catalog.json": "6e31090396ce1102fcb87c3691563c926eadf63068549d931d0579cd2361f289",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "c2406c9486687d902a0deee3398cd5efa75a500c89136df5c8a014bf90313c1e",
+    "data/framework-control-gaps.json": "d46d49d52ec73dc7d08b49b1b0a69abe36cbb409368ee17c64aa0f1c4bf9017f",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "66ef2e1f444a2cf0c2700a754f0a66030bb8a91d9e68394b9537ea1fe8b904fe",
-    "data/zeroday-lessons.json": "b813b3a35fed6214a0eec2f1ff95a8947b3096458c7136ebc1882e6867220823",
+    "data/zeroday-lessons.json": "6c3223be1ceeac535a4022f9fe7e4a66cb8e50eaecb8a0523bc156130b2cf7a3",
     "skills/kernel-lpe-triage/skill.md": "08b3e9815ba481c57c80f5fc0ccbf5bb7cbb41f570c235ba6ff9596b8c07354d",
     "skills/ai-attack-surface/skill.md": "c4c1eb22a38ca7a959b5725222bab8fbd4f4044a548a93f3e288e6f698334b72",
     "skills/mcp-agent-trust/skill.md": "89ac89084391d2341b6513fefb1be2d36b93de1c130f057696219c1c59440f13",
@@ -72,7 +72,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 538,
-    "chains_cve_entries": 328,
+    "chains_cve_entries": 329,
     "chains_cwe_entries": 171,
     "jurisdictions_indexed": 29,
     "handoff_dag_nodes": 42,

package/data/_indexes/activity-feed.json

@@ -149,7 +149,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 339
+      "entry_count": 340
     },
     {
       "date": "2026-05-18",
@@ -165,7 +165,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 334
+      "entry_count": 335
     },
     {
       "date": "2026-05-17",

package/data/_indexes/catalog-summaries.json

@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 339,
+      "entry_count": 340,
       "sample_keys": [
         "CVE-2025-53773",
         "CVE-2026-30615",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 334,
+      "entry_count": 335,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -22625,6 +22625,422 @@
       ]
     }
   },
+  "CVE-2023-48022": {
+    "name": "Anyscale Ray Job Submission API Unauthenticated RCE (ShadowRay)",
+    "rwep": 68,
+    "cvss": 9.8,
+    "cisa_kev": false,
+    "epss_score": null,
+    "referencing_skills": [
+      "kernel-lpe-triage",
+      "ai-attack-surface",
+      "compliance-theater",
+      "ai-c2-detection",
+      "attack-surface-pentest",
+      "dlp-gap-analysis",
+      "ot-ics-security",
+      "sector-energy"
+    ],
+    "chain": {
+      "cwes": [
+        {
+          "id": "CWE-1037",
+          "name": "Processor Optimization Removal or Modification of Security-critical Code",
+          "category": "Hardware / Side Channel"
+        },
+        {
+          "id": "CWE-1039",
+          "name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
+          "category": "AI/ML"
+        },
+        {
+          "id": "CWE-125",
+          "name": "Out-of-bounds Read",
+          "category": "Memory Safety"
+        },
+        {
+          "id": "CWE-1395",
+          "name": "Dependency on Vulnerable Third-Party Component",
+          "category": "Supply Chain"
+        },
+        {
+          "id": "CWE-1426",
+          "name": "Improper Validation of Generative AI Output",
+          "category": "AI/ML"
+        },
+        {
+          "id": "CWE-200",
+          "name": "Exposure of Sensitive Information to an Unauthorized Actor",
+          "category": "Information Exposure"
+        },
+        {
+          "id": "CWE-22",
+          "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
+          "category": "Path/Resource"
+        },
+        {
+          "id": "CWE-269",
+          "name": "Improper Privilege Management",
+          "category": "Authorization"
+        },
+        {
+          "id": "CWE-287",
+          "name": "Improper Authentication",
+          "category": "Authentication"
+        },
+        {
+          "id": "CWE-306",
+          "name": "Missing Authentication for Critical Function",
+          "category": "Authentication"
+        },
+        {
+          "id": "CWE-352",
+          "name": "Cross-Site Request Forgery (CSRF)",
+          "category": "Session"
+        },
+        {
+          "id": "CWE-362",
+          "name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
+          "category": "Concurrency"
+        },
+        {
+          "id": "CWE-416",
+          "name": "Use After Free",
+          "category": "Memory Safety"
+        },
+        {
+          "id": "CWE-434",
+          "name": "Unrestricted Upload of File with Dangerous Type",
+          "category": "File Handling"
+        },
+        {
+          "id": "CWE-672",
+          "name": "Operation on a Resource after Expiration or Release",
+          "category": "Memory Safety"
+        },
+        {
+          "id": "CWE-732",
+          "name": "Incorrect Permission Assignment for Critical Resource",
+          "category": "Authorization"
+        },
+        {
+          "id": "CWE-78",
+          "name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
+          "category": "Injection"
+        },
+        {
+          "id": "CWE-787",
+          "name": "Out-of-bounds Write",
+          "category": "Memory Safety"
+        },
+        {
+          "id": "CWE-79",
+          "name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
+          "category": "Injection"
+        },
+        {
+          "id": "CWE-798",
+          "name": "Use of Hard-coded Credentials",
+          "category": "Credentials"
+        },
+        {
+          "id": "CWE-89",
+          "name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
+          "category": "Injection"
+        },
+        {
+          "id": "CWE-918",
+          "name": "Server-Side Request Forgery (SSRF)",
+          "category": "Network"
+        },
+        {
+          "id": "CWE-94",
+          "name": "Improper Control of Generation of Code (Code Injection)",
+          "category": "Injection"
+        }
+      ],
+      "atlas": [
+        {
+          "id": "AML.T0010",
+          "name": "ML Supply Chain Compromise",
+          "tactic": "Initial Access"
+        },
+        {
+          "id": "AML.T0016",
+          "name": "Obtain Capabilities: Develop Capabilities",
+          "tactic": "Resource Development"
+        },
+        {
+          "id": "AML.T0017",
+          "name": "Discover ML Model Ontology",
+          "tactic": "Discovery"
+        },
+        {
+          "id": "AML.T0018",
+          "name": "Backdoor ML Model",
+          "tactic": "Persistence"
+        },
+        {
+          "id": "AML.T0020",
+          "name": "Poison Training Data",
+          "tactic": "ML Attack Staging"
+        },
+        {
+          "id": "AML.T0043",
+          "name": "Craft Adversarial Data",
+          "tactic": "ML Attack Staging"
+        },
+        {
+          "id": "AML.T0051",
+          "name": "LLM Prompt Injection",
+          "tactic": "Execution"
+        },
+        {
+          "id": "AML.T0054",
+          "name": "LLM Jailbreak",
+          "tactic": "Defense Evasion"
+        },
+        {
+          "id": "AML.T0096",
+          "name": "AI API as Covert C2 Channel",
+          "tactic": "Command and Control"
+        }
+      ],
+      "d3fend": [
+        {
+          "id": "D3-ASLR",
+          "name": "Address Space Layout Randomization",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-CA",
+          "name": "Certificate Analysis",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-CSPP",
+          "name": "Client-server Payload Profiling",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-DA",
+          "name": "Domain Analysis",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-EAL",
+          "name": "Executable Allowlisting",
+          "tactic": "Harden"
+        },
+        {
+          "id": "D3-IOPR",
+          "name": "Input/Output Profiling Resource",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-NI",
+          "name": "Network Isolation",
+          "tactic": "Isolate"
+        },
+        {
+          "id": "D3-NTA",
+          "name": "Network Traffic Analysis",
+          "tactic": "Detect"
+        },
+        {
+          "id": "D3-NTPM",
+          "name": "Network Traffic Policy Mapping",
+          "tactic": "Model"
+        },
+        {
+          "id": "D3-PHRA",
+          "name": "Process Hardware Resource Access",
+          "tactic": "Isolate"
+        },
+        {
+          "id": "D3-PSEP",
+          "name": "Process Segment Execution Prevention",
+          "tactic": "Harden"
+        }
+      ],
+      "framework_gaps": [
+        {
+          "id": "ALL-AI-PIPELINE-INTEGRITY",
+          "framework": "ALL",
+          "control_name": "AI Pipeline Integrity"
+        },
+        {
+          "id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
+          "framework": "ALL",
+          "control_name": "Prompt Injection as Access Control Failure"
+        },
+        {
+          "id": "CIS-Controls-v8-Control7",
+          "framework": "CIS Controls v8",
+          "control_name": "Continuous Vulnerability Management"
+        },
+        {
+          "id": "CMMC-2.0-Level-2",
+          "framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
+          "control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
+        },
+        {
+          "id": "FedRAMP-Rev5-Moderate",
+          "framework": "FedRAMP Rev 5 Moderate",
+          "control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
+        },
+        {
+          "id": "HIPAA-Security-Rule-164.312(a)(1)",
+          "framework": "HIPAA Security Rule (45 CFR § 164.312)",
+          "control_name": "Access control standard (technical safeguards)"
+        },
+        {
+          "id": "IEC-62443-3-3",
+          "framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
+          "control_name": "System security requirements and security levels"
+        },
+        {
+          "id": "ISO-27001-2022-A.8.16",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Monitoring activities"
+        },
+        {
+          "id": "ISO-27001-2022-A.8.28",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Secure coding"
+        },
+        {
+          "id": "ISO-27001-2022-A.8.8",
+          "framework": "ISO/IEC 27001:2022",
+          "control_name": "Management of technical vulnerabilities"
+        },
+        {
+          "id": "ISO-IEC-23894-2023-clause-7",
+          "framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
+          "control_name": "AI risk management process"
+        },
+        {
+          "id": "ISO-IEC-42001-2023-clause-6.1.2",
+          "framework": "ISO/IEC 42001:2023 (AI Management System)",
+          "control_name": "AI risk assessment"
+        },
+        {
+          "id": "NERC-CIP-007-6-R4",
+          "framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
+          "control_name": "Security event monitoring"
+        },
+        {
+          "id": "NIS2-Art21-patch-management",
+          "framework": "EU NIS2 Directive",
+          "control_name": "Vulnerability handling and disclosure"
+        },
+        {
+          "id": "NIST-800-115",
+          "framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
+          "control_name": "Technical Guide to Information Security Testing and Assessment"
+        },
+        {
+          "id": "NIST-800-53-AC-2",
+          "framework": "NIST SP 800-53 Rev 5",
+          "control_name": "Account Management"
+        },
+        {
+          "id": "NIST-800-53-SC-28",
+          "framework": "NIST SP 800-53 Rev 5",
+          "control_name": "Protection of Information at Rest"
+        },
+        {
+          "id": "NIST-800-53-SC-7",
+          "framework": "NIST SP 800-53 Rev 5",
+          "control_name": "Boundary Protection"
+        },
+        {
+          "id": "NIST-800-53-SC-8",
+          "framework": "NIST SP 800-53 Rev 5",
+          "control_name": "Transmission Confidentiality and Integrity"
+        },
+        {
+          "id": "NIST-800-53-SI-2",
+          "framework": "NIST SP 800-53 Rev 5",
+          "control_name": "Flaw Remediation"
+        },
+        {
+          "id": "NIST-800-53-SI-3",
+          "framework": "NIST SP 800-53 Rev 5",
+          "control_name": "Malicious Code Protection"
+        },
+        {
+          "id": "NIST-800-82r3",
+          "framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
+          "control_name": "Guide to Operational Technology (OT) Security"
+        },
+        {
+          "id": "OWASP-LLM-Top-10-2025-LLM01",
+          "framework": "OWASP Top 10 for LLM Applications 2025",
+          "control_name": "Prompt Injection"
+        },
+        {
+          "id": "OWASP-LLM-Top-10-2025-LLM02",
+          "framework": "OWASP Top 10 for LLM Applications 2025",
+          "control_name": "Sensitive Information Disclosure"
+        },
+        {
+          "id": "OWASP-Pen-Testing-Guide-v5",
+          "framework": "OWASP Web Security Testing Guide v5 (WSTG)",
+          "control_name": "Web application penetration testing methodology"
+        },
+        {
+          "id": "PCI-DSS-4.0-6.3.3",
+          "framework": "PCI DSS 4.0",
+          "control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
+        },
+        {
+          "id": "PTES-Pre-engagement",
+          "framework": "Penetration Testing Execution Standard (PTES)",
+          "control_name": "Pre-engagement Interactions"
+        },
+        {
+          "id": "SOC2-CC6-logical-access",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "Logical and Physical Access Controls"
+        },
+        {
+          "id": "SOC2-CC7-anomaly-detection",
+          "framework": "SOC 2 (AICPA Trust Services Criteria)",
+          "control_name": "System Operations — Threat and Vulnerability Management"
+        }
+      ],
+      "attack_refs": [
+        "T0855",
+        "T0883",
+        "T1041",
+        "T1059",
+        "T1068",
+        "T1071",
+        "T1078",
+        "T1102",
+        "T1133",
+        "T1190",
+        "T1213",
+        "T1530",
+        "T1548.001",
+        "T1566",
+        "T1567",
+        "T1568"
+      ],
+      "rfc_refs": [
+        "RFC-4301",
+        "RFC-4303",
+        "RFC-7296",
+        "RFC-8446",
+        "RFC-9000",
+        "RFC-9114",
+        "RFC-9180",
+        "RFC-9421",
+        "RFC-9458"
+      ]
+    }
+  },
   "CVE-2026-41091": {
     "name": "Microsoft Defender (Malware Protection Engine) Link-Following LPE to SYSTEM",
     "rwep": 45,
@@ -49001,6 +49417,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -49367,6 +49784,7 @@
     },
     "related_cves": [
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-50050",
       "CVE-2025-0133",
       "CVE-2025-10585",
@@ -49524,6 +49942,7 @@
     },
     "related_cves": [
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-50050",
       "CVE-2025-0133",
       "CVE-2025-10585",
@@ -49695,6 +50114,7 @@
     },
     "related_cves": [
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-50050",
       "CVE-2025-0133",
       "CVE-2025-10585",
@@ -49970,6 +50390,7 @@
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -50199,6 +50620,7 @@
       "CVE-2023-39780",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2023-48022",
       "CVE-2023-50224",
       "CVE-2023-52163",
       "CVE-2024-0769",
@@ -50652,6 +51074,7 @@
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-40635",
@@ -51008,6 +51431,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -51604,6 +52028,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -51838,6 +52263,7 @@
       ]
     },
     "related_cves": [
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-50050",
       "CVE-2025-10585",
@@ -52498,6 +52924,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -52734,6 +53161,7 @@
       "CVE-2023-39780",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2023-48022",
       "CVE-2023-50224",
       "CVE-2023-52163",
       "CVE-2024-0769",
@@ -53151,6 +53579,7 @@
       "CVE-2023-39780",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2023-48022",
       "CVE-2023-50224",
       "CVE-2023-52163",
       "CVE-2024-0769",
@@ -53601,6 +54030,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -54389,6 +54819,7 @@
       "CVE-2023-39780",
       "CVE-2023-41974",
       "CVE-2023-43000",
+      "CVE-2023-48022",
       "CVE-2023-50224",
       "CVE-2023-52163",
       "CVE-2024-0769",
@@ -54903,6 +55334,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -55217,6 +55649,7 @@
       "CVE-2023-41974",
       "CVE-2023-43000",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2023-50224",
       "CVE-2023-52163",
       "CVE-2024-0769",
@@ -55750,6 +56183,7 @@
     },
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -56681,6 +57115,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -56776,6 +57211,7 @@
       "rfc_refs": []
     },
     "related_cves": [
+      "CVE-2023-48022",
       "CVE-2024-50050",
       "CVE-2025-10585",
       "CVE-2025-1094",
@@ -56941,6 +57377,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-50050",
       "CVE-2025-0133",
       "CVE-2025-1094",
@@ -57796,6 +58233,7 @@
     "related_cves": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-3154",
       "CVE-2024-50050",
@@ -58084,6 +58522,7 @@
       "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
       "BUG-2026-NIGHTMARE-ECLIPSE-YELLOWKEY",
       "CVE-2023-43472",
+      "CVE-2023-48022",
       "CVE-2024-3094",
       "CVE-2024-40635",
       "CVE-2024-50050",