@blamejs/exceptd-skills 0.14.25 → 0.14.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/CHANGELOG.md +14 -0
  2. package/data/_indexes/_meta.json +9 -9
  3. package/data/_indexes/activity-feed.json +3 -3
  4. package/data/_indexes/catalog-summaries.json +7 -7
  5. package/data/_indexes/chains.json +1125 -0
  6. package/data/_indexes/frequency.json +2 -0
  7. package/data/atlas-ttps.json +29 -17
  8. package/data/attack-techniques.json +43 -36
  9. package/data/cve-catalog.json +321 -2
  10. package/data/cwe-catalog.json +22 -19
  11. package/data/framework-control-gaps.json +197 -116
  12. package/data/playbooks/framework.json +1 -0
  13. package/data/playbooks/sbom.json +1 -0
  14. package/data/zeroday-lessons.json +211 -0
  15. package/lib/collectors/citation-hygiene.js +59 -21
  16. package/manifest.json +44 -44
  17. package/package.json +1 -1
  18. package/sbom.cdx.json +30 -30
package/data/framework-control-gaps.json CHANGED
@@ -16,7 +16,7 @@
16
16
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
17
17
  },
18
18
  "last_threat_review": "2026-05-15",
19
- "entry_count": 192
19
+ "entry_count": 194
20
20
  },
21
21
  "ALL-AI-PIPELINE-INTEGRITY": {
22
22
  "framework": "ALL",
@@ -52,6 +52,7 @@
52
52
  "CVE-2024-11393",
53
53
  "CVE-2024-11394",
54
54
  "CVE-2024-12366",
55
+ "CVE-2024-12450",
55
56
  "CVE-2024-12776",
56
57
  "CVE-2024-13059",
57
58
  "CVE-2024-1561",
@@ -61,6 +62,7 @@
61
62
  "CVE-2024-24591",
62
63
  "CVE-2024-27132",
63
64
  "CVE-2024-2912",
65
+ "CVE-2024-31462",
64
66
  "CVE-2024-37032",
65
67
  "CVE-2024-37052",
66
68
  "CVE-2024-37060",
@@ -72,6 +74,7 @@
72
74
  "CVE-2024-5565",
73
75
  "CVE-2024-6587",
74
76
  "CVE-2024-9526",
77
+ "CVE-2025-10164",
75
78
  "CVE-2025-1550",
76
79
  "CVE-2025-1753",
77
80
  "CVE-2025-1796",
@@ -88,14 +91,21 @@
88
91
  "CVE-2025-34291",
89
92
  "CVE-2025-3466",
90
93
  "CVE-2025-49596",
94
+ "CVE-2025-51480",
91
95
  "CVE-2025-54136",
92
96
  "CVE-2025-56520",
93
97
  "CVE-2025-60455",
94
98
  "CVE-2025-64496",
95
99
  "CVE-2025-64513",
96
100
  "CVE-2025-67818",
101
+ "CVE-2025-68668",
102
+ "CVE-2025-69286",
97
103
  "CVE-2025-8747",
98
104
  "CVE-2026-0766",
105
+ "CVE-2026-21858",
106
+ "CVE-2026-21877",
107
+ "CVE-2026-22218",
108
+ "CVE-2026-22219",
99
109
  "CVE-2026-22252",
100
110
  "CVE-2026-22688",
101
111
  "CVE-2026-24206",
@@ -105,6 +115,8 @@
105
115
  "CVE-2026-24215",
106
116
  "CVE-2026-26015",
107
117
  "CVE-2026-26190",
118
+ "CVE-2026-3059",
119
+ "CVE-2026-3060",
108
120
  "CVE-2026-30616",
109
121
  "CVE-2026-30617",
110
122
  "CVE-2026-30624",
@@ -117,19 +129,7 @@
117
129
  "CVE-2026-41947",
118
130
  "CVE-2026-41950",
119
131
  "CVE-2026-45829",
120
- "CVE-2024-12450",
121
- "CVE-2025-69286",
122
- "CVE-2026-22218",
123
- "CVE-2026-22219",
124
- "CVE-2025-51480",
125
- "CVE-2025-10164",
126
- "CVE-2026-5760",
127
- "CVE-2026-21858",
128
- "CVE-2025-68668",
129
- "CVE-2024-31462",
130
- "CVE-2026-3059",
131
- "CVE-2026-3060",
132
- "CVE-2026-21877"
132
+ "CVE-2026-5760"
133
133
  ],
134
134
  "atlas_refs": [
135
135
  "AML.T0018",
@@ -1310,28 +1310,28 @@
1310
1310
  "CVE-2024-24590",
1311
1311
  "CVE-2024-24591",
1312
1312
  "CVE-2024-2912",
1313
+ "CVE-2024-31462",
1313
1314
  "CVE-2024-37052",
1314
1315
  "CVE-2024-37060",
1315
1316
  "CVE-2024-5565",
1316
1317
  "CVE-2024-9526",
1317
1318
  "CVE-2025-0133",
1319
+ "CVE-2025-10164",
1318
1320
  "CVE-2025-1094",
1319
1321
  "CVE-2025-27520",
1320
1322
  "CVE-2025-3248",
1321
1323
  "CVE-2025-3466",
1324
+ "CVE-2025-51480",
1325
+ "CVE-2025-68668",
1322
1326
  "CVE-2025-6965",
1327
+ "CVE-2026-21858",
1328
+ "CVE-2026-21877",
1329
+ "CVE-2026-22218",
1323
1330
  "CVE-2026-30623",
1324
1331
  "CVE-2026-31229",
1325
1332
  "CVE-2026-31230",
1326
1333
  "CVE-2026-33017",
1327
- "CVE-2026-22218",
1328
- "CVE-2025-51480",
1329
- "CVE-2025-10164",
1330
- "CVE-2026-5760",
1331
- "CVE-2026-21858",
1332
- "CVE-2025-68668",
1333
- "CVE-2024-31462",
1334
- "CVE-2026-21877"
1334
+ "CVE-2026-5760"
1335
1335
  ],
1336
1336
  "atlas_refs": [
1337
1337
  "AML.T0051",
@@ -1365,7 +1365,10 @@
1365
1365
  "opened_date": "2026-04-01",
1366
1366
  "evidence_cves": [
1367
1367
  "CVE-2024-3094",
1368
+ "CVE-2025-30066",
1369
+ "CVE-2025-30154",
1368
1370
  "CVE-2026-30615",
1371
+ "CVE-2026-48027",
1369
1372
  "MAL-2024-PYPI-ULTRALYTICS-XMRIG"
1370
1373
  ],
1371
1374
  "atlas_refs": [
@@ -1693,6 +1696,8 @@
1693
1696
  "CVE-2026-26015",
1694
1697
  "CVE-2026-26190",
1695
1698
  "CVE-2026-3055",
1699
+ "CVE-2026-3059",
1700
+ "CVE-2026-3060",
1696
1701
  "CVE-2026-30616",
1697
1702
  "CVE-2026-30617",
1698
1703
  "CVE-2026-30624",
@@ -1717,10 +1722,9 @@
1717
1722
  "CVE-2026-45829",
1718
1723
  "CVE-2026-46300",
1719
1724
  "CVE-2026-46333",
1725
+ "CVE-2026-48027",
1720
1726
  "CVE-2026-5281",
1721
- "CVE-2026-9082",
1722
- "CVE-2026-3059",
1723
- "CVE-2026-3060"
1727
+ "CVE-2026-9082"
1724
1728
  ],
1725
1729
  "atlas_refs": [],
1726
1730
  "attack_refs": [
@@ -2086,6 +2090,9 @@
2086
2090
  "opened_date": "2026-05-17",
2087
2091
  "evidence_cves": [
2088
2092
  "CVE-2024-3094",
2093
+ "CVE-2025-30066",
2094
+ "CVE-2025-30154",
2095
+ "CVE-2026-48027",
2089
2096
  "MAL-2026-SHAI-HULUD-OSS",
2090
2097
  "MAL-2026-TANSTACK-MINI"
2091
2098
  ],
@@ -2320,6 +2327,7 @@
2320
2327
  "CVE-2023-51449",
2321
2328
  "CVE-2023-6038",
2322
2329
  "CVE-2024-0132",
2330
+ "CVE-2024-12450",
2323
2331
  "CVE-2024-1561",
2324
2332
  "CVE-2024-21575",
2325
2333
  "CVE-2024-21576",
@@ -2332,13 +2340,12 @@
2332
2340
  "CVE-2025-32444",
2333
2341
  "CVE-2025-53767",
2334
2342
  "CVE-2025-56520",
2335
- "CVE-2026-34159",
2336
- "CVE-2026-42897",
2337
- "CVE-2024-12450",
2338
2343
  "CVE-2026-22219",
2339
- "CVE-2026-5760",
2340
2344
  "CVE-2026-3059",
2341
- "CVE-2026-3060"
2345
+ "CVE-2026-3060",
2346
+ "CVE-2026-34159",
2347
+ "CVE-2026-42897",
2348
+ "CVE-2026-5760"
2342
2349
  ],
2343
2350
  "atlas_refs": [
2344
2351
  "AML.T0096",
@@ -2413,12 +2420,14 @@
2413
2420
  "CVE-2024-11393",
2414
2421
  "CVE-2024-11394",
2415
2422
  "CVE-2024-12366",
2423
+ "CVE-2024-12450",
2416
2424
  "CVE-2024-13059",
2417
2425
  "CVE-2024-21513",
2418
2426
  "CVE-2024-24590",
2419
2427
  "CVE-2024-24591",
2420
2428
  "CVE-2024-27132",
2421
2429
  "CVE-2024-2912",
2430
+ "CVE-2024-31462",
2422
2431
  "CVE-2024-37032",
2423
2432
  "CVE-2024-37052",
2424
2433
  "CVE-2024-37060",
@@ -2427,6 +2436,7 @@
2427
2436
  "CVE-2024-5565",
2428
2437
  "CVE-2024-9526",
2429
2438
  "CVE-2025-0133",
2439
+ "CVE-2025-10164",
2430
2440
  "CVE-2025-1094",
2431
2441
  "CVE-2025-1550",
2432
2442
  "CVE-2025-1753",
@@ -2437,6 +2447,7 @@
2437
2447
  "CVE-2025-32434",
2438
2448
  "CVE-2025-33236",
2439
2449
  "CVE-2025-3466",
2450
+ "CVE-2025-51480",
2440
2451
  "CVE-2025-56520",
2441
2452
  "CVE-2025-60455",
2442
2453
  "CVE-2025-64496",
@@ -2444,6 +2455,10 @@
2444
2455
  "CVE-2025-6965",
2445
2456
  "CVE-2025-8747",
2446
2457
  "CVE-2026-0766",
2458
+ "CVE-2026-21858",
2459
+ "CVE-2026-21877",
2460
+ "CVE-2026-22218",
2461
+ "CVE-2026-22219",
2447
2462
  "CVE-2026-24213",
2448
2463
  "CVE-2026-24214",
2449
2464
  "CVE-2026-24215",
@@ -2452,16 +2467,8 @@
2452
2467
  "CVE-2026-39884",
2453
2468
  "CVE-2026-42208",
2454
2469
  "CVE-2026-45829",
2455
- "CVE-2026-9082",
2456
- "CVE-2024-12450",
2457
- "CVE-2026-22218",
2458
- "CVE-2026-22219",
2459
- "CVE-2025-51480",
2460
- "CVE-2025-10164",
2461
2470
  "CVE-2026-5760",
2462
- "CVE-2026-21858",
2463
- "CVE-2024-31462",
2464
- "CVE-2026-21877"
2471
+ "CVE-2026-9082"
2465
2472
  ],
2466
2473
  "atlas_refs": [
2467
2474
  "AML.T0053"
@@ -2639,6 +2646,7 @@
2639
2646
  "CVE-2024-8068",
2640
2647
  "CVE-2024-8069",
2641
2648
  "CVE-2025-10035",
2649
+ "CVE-2025-10164",
2642
2650
  "CVE-2025-10585",
2643
2651
  "CVE-2025-11371",
2644
2652
  "CVE-2025-11953",
@@ -2835,6 +2843,8 @@
2835
2843
  "CVE-2026-26015",
2836
2844
  "CVE-2026-26190",
2837
2845
  "CVE-2026-3055",
2846
+ "CVE-2026-3059",
2847
+ "CVE-2026-3060",
2838
2848
  "CVE-2026-30616",
2839
2849
  "CVE-2026-30617",
2840
2850
  "CVE-2026-30624",
@@ -2868,10 +2878,7 @@
2868
2878
  "CVE-2026-46333",
2869
2879
  "CVE-2026-5281",
2870
2880
  "CVE-2026-6973",
2871
- "CVE-2026-9082",
2872
- "CVE-2025-10164",
2873
- "CVE-2026-3059",
2874
- "CVE-2026-3060"
2881
+ "CVE-2026-9082"
2875
2882
  ],
2876
2883
  "atlas_refs": [],
2877
2884
  "attack_refs": [
@@ -2913,12 +2920,12 @@
2913
2920
  "CVE-2025-27520",
2914
2921
  "CVE-2025-3248",
2915
2922
  "CVE-2025-3466",
2923
+ "CVE-2025-68668",
2924
+ "CVE-2026-21877",
2916
2925
  "CVE-2026-22778",
2917
2926
  "CVE-2026-32202",
2918
2927
  "CVE-2026-33017",
2919
- "CVE-2026-33825",
2920
- "CVE-2025-68668",
2921
- "CVE-2026-21877"
2928
+ "CVE-2026-33825"
2922
2929
  ],
2923
2930
  "atlas_refs": [
2924
2931
  "AML.T0017"
@@ -2956,10 +2963,11 @@
2956
2963
  "CVE-2024-3094",
2957
2964
  "CVE-2024-37052",
2958
2965
  "CVE-2024-37060",
2959
- "MAL-2026-SHAI-HULUD-OSS",
2960
- "CVE-2025-51480",
2961
2966
  "CVE-2025-10164",
2962
- "CVE-2026-5760"
2967
+ "CVE-2025-30154",
2968
+ "CVE-2025-51480",
2969
+ "CVE-2026-5760",
2970
+ "MAL-2026-SHAI-HULUD-OSS"
2963
2971
  ],
2964
2972
  "atlas_refs": [
2965
2973
  "AML.T0010"
@@ -3643,6 +3651,8 @@
3643
3651
  "opened_date": "2026-05-11",
3644
3652
  "evidence_cves": [
3645
3653
  "CVE-2024-3094",
3654
+ "CVE-2025-30066",
3655
+ "CVE-2025-30154",
3646
3656
  "CVE-2026-45321",
3647
3657
  "MAL-2026-3083",
3648
3658
  "MAL-2026-NODE-IPC-STEALER",
@@ -3933,12 +3943,12 @@
3933
3943
  "CVE-2024-6587",
3934
3944
  "CVE-2025-1796",
3935
3945
  "CVE-2025-64513",
3946
+ "CVE-2025-69286",
3936
3947
  "CVE-2026-24206",
3937
3948
  "CVE-2026-24207",
3938
3949
  "CVE-2026-26190",
3939
3950
  "CVE-2026-41947",
3940
- "CVE-2026-41950",
3941
- "CVE-2025-69286"
3951
+ "CVE-2026-41950"
3942
3952
  ],
3943
3953
  "atlas_refs": [
3944
3954
  "AML.T0010",
@@ -5172,6 +5182,7 @@
5172
5182
  "CVE-2024-11393",
5173
5183
  "CVE-2024-11394",
5174
5184
  "CVE-2024-12366",
5185
+ "CVE-2024-12450",
5175
5186
  "CVE-2024-12776",
5176
5187
  "CVE-2024-13059",
5177
5188
  "CVE-2024-1561",
@@ -5183,6 +5194,7 @@
5183
5194
  "CVE-2024-24591",
5184
5195
  "CVE-2024-27132",
5185
5196
  "CVE-2024-2912",
5197
+ "CVE-2024-31462",
5186
5198
  "CVE-2024-37032",
5187
5199
  "CVE-2024-37052",
5188
5200
  "CVE-2024-37060",
@@ -5194,6 +5206,7 @@
5194
5206
  "CVE-2024-5565",
5195
5207
  "CVE-2024-6587",
5196
5208
  "CVE-2024-9526",
5209
+ "CVE-2025-10164",
5197
5210
  "CVE-2025-1550",
5198
5211
  "CVE-2025-1753",
5199
5212
  "CVE-2025-1796",
@@ -5210,16 +5223,23 @@
5210
5223
  "CVE-2025-34291",
5211
5224
  "CVE-2025-3466",
5212
5225
  "CVE-2025-49596",
5226
+ "CVE-2025-51480",
5213
5227
  "CVE-2025-54136",
5214
5228
  "CVE-2025-56520",
5215
5229
  "CVE-2025-60455",
5216
5230
  "CVE-2025-64496",
5217
5231
  "CVE-2025-64513",
5218
5232
  "CVE-2025-67818",
5233
+ "CVE-2025-68668",
5234
+ "CVE-2025-69286",
5219
5235
  "CVE-2025-8747",
5220
5236
  "CVE-2026-0300",
5221
5237
  "CVE-2026-0766",
5222
5238
  "CVE-2026-20182",
5239
+ "CVE-2026-21858",
5240
+ "CVE-2026-21877",
5241
+ "CVE-2026-22218",
5242
+ "CVE-2026-22219",
5223
5243
  "CVE-2026-22252",
5224
5244
  "CVE-2026-22688",
5225
5245
  "CVE-2026-24206",
@@ -5230,6 +5250,8 @@
5230
5250
  "CVE-2026-25592",
5231
5251
  "CVE-2026-26015",
5232
5252
  "CVE-2026-26190",
5253
+ "CVE-2026-3059",
5254
+ "CVE-2026-3060",
5233
5255
  "CVE-2026-30616",
5234
5256
  "CVE-2026-30617",
5235
5257
  "CVE-2026-30624",
@@ -5249,20 +5271,8 @@
5249
5271
  "CVE-2026-45829",
5250
5272
  "CVE-2026-46300",
5251
5273
  "CVE-2026-46333",
5252
- "CVE-2026-9082",
5253
- "CVE-2024-12450",
5254
- "CVE-2025-69286",
5255
- "CVE-2026-22218",
5256
- "CVE-2026-22219",
5257
- "CVE-2025-51480",
5258
- "CVE-2025-10164",
5259
5274
  "CVE-2026-5760",
5260
- "CVE-2026-21858",
5261
- "CVE-2025-68668",
5262
- "CVE-2024-31462",
5263
- "CVE-2026-3059",
5264
- "CVE-2026-3060",
5265
- "CVE-2026-21877"
5275
+ "CVE-2026-9082"
5266
5276
  ],
5267
5277
  "atlas_refs": [],
5268
5278
  "attack_refs": [
@@ -5302,23 +5312,23 @@
5302
5312
  "CVE-2023-6038",
5303
5313
  "CVE-2024-12776",
5304
5314
  "CVE-2024-1709",
5315
+ "CVE-2024-31462",
5305
5316
  "CVE-2025-1796",
5306
5317
  "CVE-2025-25297",
5307
5318
  "CVE-2025-3248",
5308
5319
  "CVE-2025-3466",
5309
5320
  "CVE-2025-56520",
5321
+ "CVE-2025-68668",
5322
+ "CVE-2025-69286",
5323
+ "CVE-2026-21858",
5324
+ "CVE-2026-21877",
5325
+ "CVE-2026-22218",
5326
+ "CVE-2026-22219",
5310
5327
  "CVE-2026-33017",
5311
5328
  "CVE-2026-39987",
5312
5329
  "CVE-2026-41947",
5313
5330
  "CVE-2026-41950",
5314
- "CVE-2026-7482",
5315
- "CVE-2025-69286",
5316
- "CVE-2026-22218",
5317
- "CVE-2026-22219",
5318
- "CVE-2026-21858",
5319
- "CVE-2025-68668",
5320
- "CVE-2024-31462",
5321
- "CVE-2026-21877"
5331
+ "CVE-2026-7482"
5322
5332
  ],
5323
5333
  "atlas_refs": [
5324
5334
  "AML.T0051"
@@ -5617,11 +5627,11 @@
5617
5627
  "CVE-2024-12776",
5618
5628
  "CVE-2025-1796",
5619
5629
  "CVE-2025-3248",
5630
+ "CVE-2025-69286",
5620
5631
  "CVE-2026-33017",
5621
5632
  "CVE-2026-41947",
5622
5633
  "CVE-2026-41950",
5623
- "CVE-2026-6973",
5624
- "CVE-2025-69286"
5634
+ "CVE-2026-6973"
5625
5635
  ],
5626
5636
  "atlas_refs": [],
5627
5637
  "attack_refs": [
@@ -5794,6 +5804,7 @@
5794
5804
  "CVE-2024-11393",
5795
5805
  "CVE-2024-11394",
5796
5806
  "CVE-2024-12366",
5807
+ "CVE-2024-12450",
5797
5808
  "CVE-2024-13059",
5798
5809
  "CVE-2024-1561",
5799
5810
  "CVE-2024-21513",
@@ -5804,6 +5815,7 @@
5804
5815
  "CVE-2024-24591",
5805
5816
  "CVE-2024-27132",
5806
5817
  "CVE-2024-2912",
5818
+ "CVE-2024-31462",
5807
5819
  "CVE-2024-37032",
5808
5820
  "CVE-2024-37052",
5809
5821
  "CVE-2024-37060",
@@ -5813,6 +5825,7 @@
5813
5825
  "CVE-2024-50050",
5814
5826
  "CVE-2024-5565",
5815
5827
  "CVE-2024-9526",
5828
+ "CVE-2025-10164",
5816
5829
  "CVE-2025-1550",
5817
5830
  "CVE-2025-1753",
5818
5831
  "CVE-2025-23254",
@@ -5828,13 +5841,19 @@
5828
5841
  "CVE-2025-34291",
5829
5842
  "CVE-2025-3466",
5830
5843
  "CVE-2025-49596",
5844
+ "CVE-2025-51480",
5831
5845
  "CVE-2025-54136",
5832
5846
  "CVE-2025-56520",
5833
5847
  "CVE-2025-60455",
5834
5848
  "CVE-2025-64496",
5835
5849
  "CVE-2025-67818",
5850
+ "CVE-2025-68668",
5836
5851
  "CVE-2025-8747",
5837
5852
  "CVE-2026-0766",
5853
+ "CVE-2026-21858",
5854
+ "CVE-2026-21877",
5855
+ "CVE-2026-22218",
5856
+ "CVE-2026-22219",
5838
5857
  "CVE-2026-22252",
5839
5858
  "CVE-2026-22688",
5840
5859
  "CVE-2026-24213",
@@ -5842,6 +5861,8 @@
5842
5861
  "CVE-2026-24215",
5843
5862
  "CVE-2026-25592",
5844
5863
  "CVE-2026-26015",
5864
+ "CVE-2026-3059",
5865
+ "CVE-2026-3060",
5845
5866
  "CVE-2026-30616",
5846
5867
  "CVE-2026-30617",
5847
5868
  "CVE-2026-30624",
@@ -5857,20 +5878,9 @@
5857
5878
  "CVE-2026-45829",
5858
5879
  "CVE-2026-46300",
5859
5880
  "CVE-2026-46333",
5860
- "CVE-2026-9082",
5861
- "MAL-2026-SHAI-HULUD-OSS",
5862
- "CVE-2024-12450",
5863
- "CVE-2026-22218",
5864
- "CVE-2026-22219",
5865
- "CVE-2025-51480",
5866
- "CVE-2025-10164",
5867
5881
  "CVE-2026-5760",
5868
- "CVE-2026-21858",
5869
- "CVE-2025-68668",
5870
- "CVE-2024-31462",
5871
- "CVE-2026-3059",
5872
- "CVE-2026-3060",
5873
- "CVE-2026-21877"
5882
+ "CVE-2026-9082",
5883
+ "MAL-2026-SHAI-HULUD-OSS"
5874
5884
  ],
5875
5885
  "atlas_refs": [],
5876
5886
  "attack_refs": [
@@ -5920,6 +5930,7 @@
5920
5930
  "CVE-2024-11393",
5921
5931
  "CVE-2024-11394",
5922
5932
  "CVE-2024-12366",
5933
+ "CVE-2024-12450",
5923
5934
  "CVE-2024-12776",
5924
5935
  "CVE-2024-13059",
5925
5936
  "CVE-2024-1561",
@@ -5931,6 +5942,7 @@
5931
5942
  "CVE-2024-24591",
5932
5943
  "CVE-2024-27132",
5933
5944
  "CVE-2024-2912",
5945
+ "CVE-2024-31462",
5934
5946
  "CVE-2024-37032",
5935
5947
  "CVE-2024-37052",
5936
5948
  "CVE-2024-37060",
@@ -5942,6 +5954,7 @@
5942
5954
  "CVE-2024-5565",
5943
5955
  "CVE-2024-6587",
5944
5956
  "CVE-2024-9526",
5957
+ "CVE-2025-10164",
5945
5958
  "CVE-2025-1550",
5946
5959
  "CVE-2025-1753",
5947
5960
  "CVE-2025-1796",
@@ -5958,14 +5971,21 @@
5958
5971
  "CVE-2025-34291",
5959
5972
  "CVE-2025-3466",
5960
5973
  "CVE-2025-49596",
5974
+ "CVE-2025-51480",
5961
5975
  "CVE-2025-54136",
5962
5976
  "CVE-2025-56520",
5963
5977
  "CVE-2025-60455",
5964
5978
  "CVE-2025-64496",
5965
5979
  "CVE-2025-64513",
5966
5980
  "CVE-2025-67818",
5981
+ "CVE-2025-68668",
5982
+ "CVE-2025-69286",
5967
5983
  "CVE-2025-8747",
5968
5984
  "CVE-2026-0766",
5985
+ "CVE-2026-21858",
5986
+ "CVE-2026-21877",
5987
+ "CVE-2026-22218",
5988
+ "CVE-2026-22219",
5969
5989
  "CVE-2026-22252",
5970
5990
  "CVE-2026-22688",
5971
5991
  "CVE-2026-24206",
@@ -5976,6 +5996,8 @@
5976
5996
  "CVE-2026-25592",
5977
5997
  "CVE-2026-26015",
5978
5998
  "CVE-2026-26190",
5999
+ "CVE-2026-3059",
6000
+ "CVE-2026-3060",
5979
6001
  "CVE-2026-30616",
5980
6002
  "CVE-2026-30617",
5981
6003
  "CVE-2026-30624",
@@ -5993,20 +6015,8 @@
5993
6015
  "CVE-2026-45829",
5994
6016
  "CVE-2026-46300",
5995
6017
  "CVE-2026-46333",
5996
- "CVE-2026-9082",
5997
- "CVE-2024-12450",
5998
- "CVE-2025-69286",
5999
- "CVE-2026-22218",
6000
- "CVE-2026-22219",
6001
- "CVE-2025-51480",
6002
- "CVE-2025-10164",
6003
6018
  "CVE-2026-5760",
6004
- "CVE-2026-21858",
6005
- "CVE-2025-68668",
6006
- "CVE-2024-31462",
6007
- "CVE-2026-3059",
6008
- "CVE-2026-3060",
6009
- "CVE-2026-21877"
6019
+ "CVE-2026-9082"
6010
6020
  ],
6011
6021
  "atlas_refs": [],
6012
6022
  "attack_refs": [
@@ -6309,13 +6319,13 @@
6309
6319
  "CVE-2025-3248",
6310
6320
  "CVE-2025-64513",
6311
6321
  "CVE-2025-67818",
6322
+ "CVE-2025-69286",
6312
6323
  "CVE-2026-20182",
6313
6324
  "CVE-2026-24206",
6314
6325
  "CVE-2026-24207",
6315
6326
  "CVE-2026-26190",
6316
6327
  "CVE-2026-33017",
6317
- "CVE-2026-45829",
6318
- "CVE-2025-69286"
6328
+ "CVE-2026-45829"
6319
6329
  ],
6320
6330
  "atlas_refs": [],
6321
6331
  "attack_refs": [
@@ -6351,8 +6361,8 @@
6351
6361
  "CVE-2023-43472",
6352
6362
  "CVE-2025-55319",
6353
6363
  "CVE-2025-68664",
6354
- "CVE-2026-30623",
6355
- "CVE-2025-68665"
6364
+ "CVE-2025-68665",
6365
+ "CVE-2026-30623"
6356
6366
  ],
6357
6367
  "atlas_refs": [
6358
6368
  "AML.T0010",
@@ -6425,22 +6435,22 @@
6425
6435
  "opened_date": "2026-05-18",
6426
6436
  "evidence_cves": [
6427
6437
  "CVE-2022-36551",
6438
+ "CVE-2024-12450",
6428
6439
  "CVE-2024-21762",
6440
+ "CVE-2024-31462",
6441
+ "CVE-2025-10164",
6429
6442
  "CVE-2025-25297",
6443
+ "CVE-2025-51480",
6430
6444
  "CVE-2025-56520",
6445
+ "CVE-2025-68668",
6431
6446
  "CVE-2026-20182",
6432
- "CVE-2024-12450",
6447
+ "CVE-2026-21858",
6448
+ "CVE-2026-21877",
6433
6449
  "CVE-2026-22218",
6434
6450
  "CVE-2026-22219",
6435
- "CVE-2025-51480",
6436
- "CVE-2025-10164",
6437
- "CVE-2026-5760",
6438
- "CVE-2026-21858",
6439
- "CVE-2025-68668",
6440
- "CVE-2024-31462",
6441
6451
  "CVE-2026-3059",
6442
6452
  "CVE-2026-3060",
6443
- "CVE-2026-21877"
6453
+ "CVE-2026-5760"
6444
6454
  ],
6445
6455
  "atlas_refs": [],
6446
6456
  "attack_refs": [
@@ -6666,10 +6676,10 @@
6666
6676
  "CVE-2025-55319",
6667
6677
  "CVE-2025-59529",
6668
6678
  "CVE-2025-68664",
6679
+ "CVE-2025-68665",
6669
6680
  "CVE-2025-6965",
6670
6681
  "CVE-2026-22778",
6671
- "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP",
6672
- "CVE-2025-68665"
6682
+ "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
6673
6683
  ],
6674
6684
  "theater_test": {
6675
6685
  "claim": "We are compliant with Art-15 (Accuracy, robustness, and cybersecurity of high-risk AI systems) because we follow the documented requirement: Article 15 — high-risk AI systems must be designed and developed so as to achieve an appropriate level of accuracy, robustness, and cybersecurity throughout their lifecycle. Anchored on the assumption",
@@ -7248,9 +7258,9 @@
7248
7258
  "status": "open",
7249
7259
  "opened_at": "2026-05-18",
7250
7260
  "evidence_cves": [
7261
+ "CVE-2024-12450",
7251
7262
  "CVE-2025-22224",
7252
- "CVE-2025-22225",
7253
- "CVE-2024-12450"
7263
+ "CVE-2025-22225"
7254
7264
  ],
7255
7265
  "theater_test": {
7256
7266
  "claim": "We are compliant with A.8.21 (Security of network services) because we follow the documented requirement: Annex A.8.21 — identifying, implementing, and monitoring security mechanisms, service levels, and management requirements for network services. Anchored on segmentation, secure protocols, and service-",
@@ -7998,5 +8008,76 @@
7998
8008
  ],
7999
8009
  "verdict_when_failed": "compliance-theater"
8000
8010
  }
8011
+ },
8012
+ "NIST-800-53-SR-11": {
8013
+ "framework": "NIST SP 800-53 Rev 5",
8014
+ "control_id": "SR-11",
8015
+ "control_name": "Component Authenticity",
8016
+ "designed_for": "Develop and implement anti-counterfeit policy and procedures; detect and report counterfeit or tampered system components; train personnel to recognize them. Framed around hardware/firmware counterfeiting and tamper-evident packaging in a procurement supply chain — authenticity is established by confirming the component came from the genuine vendor.",
8017
+ "misses": [
8018
+ "Equates authenticity with publisher identity. A GitHub Action whose mutable tag is repointed to malicious code, or an IDE extension published as a malicious version under the legitimate publisher account, is 'authentic' by SR-11's vendor-identity test yet fully malicious — authenticity of the principal is necessary but not sufficient when the principal or its release channel is compromised.",
8019
+ "Software artifacts distributed via registries and marketplaces (npm, PyPI, VS Code Marketplace, OpenVSX, GitHub Actions) carry no consumer-verifiable cryptographic provenance by default; SR-11's counterfeit-detection model has no artifact-level integrity check to apply.",
8020
+ "Mutable references (git tags, 'latest' marketplace versions) mean the same identifier resolves to different bytes over time; SR-11 has no concept of binding an authentic component to an immutable revision."
8021
+ ],
8022
+ "real_requirement": "SR-11 implementations for software components must require artifact-level cryptographic provenance, not publisher identity alone: full commit-SHA pinning for CI/CD actions, signed-and-verified IDE extension publishing, and build provenance attestations (sigstore / in-toto / SLSA) verified at install time. The control must explicitly treat 'authentic publisher, malicious payload' as an authenticity failure and require detection of release-channel compromise (repointed tags, anomalous marketplace publications).",
8023
+ "status": "open",
8024
+ "opened_date": "2026-05-28",
8025
+ "evidence_cves": [
8026
+ "CVE-2025-30066",
8027
+ "CVE-2026-48027"
8028
+ ],
8029
+ "atlas_refs": [
8030
+ "AML.T0010"
8031
+ ],
8032
+ "attack_refs": [
8033
+ "T1195",
8034
+ "T1195.001"
8035
+ ],
8036
+ "theater_test": {
8037
+ "claim": "Our components are authenticity-verified per NIST 800-53 SR-11.",
8038
+ "test": "Pull the SR-11 authenticity evidence for software components. Confirm it requires artifact-level provenance — full commit-SHA pinning for every third-party CI/CD action, signature verification for IDE extensions, and verified build-provenance attestations — rather than 'the artifact came from the genuine publisher account'. Sample a recent release-channel-compromise case (tj-actions tag repointing or the Nx Console marketplace compromise); verify the SR-11 procedure would have flagged an authentic-publisher malicious artifact. Theater verdict if authenticity is established by publisher identity alone with no immutable artifact binding.",
8039
+ "evidence_required": [
8040
+ "policy mandating commit-SHA pinning for CI/CD actions with an enforcement check",
8041
+ "IDE-extension signature/version verification records for managed developer hosts",
8042
+ "build-provenance (SLSA / sigstore / in-toto) verification logs at install/deploy time"
8043
+ ],
8044
+ "verdict_when_failed": "compliance-theater"
8045
+ }
8046
+ },
8047
+ "OWASP-CICD-SEC-3": {
8048
+ "framework": "OWASP Top 10 CI/CD Security Risks",
8049
+ "control_id": "CICD-SEC-3",
8050
+ "control_name": "Dependency Chain Abuse",
8051
+ "designed_for": "Prevent abuse of the dependency-resolution mechanism — dependency confusion, typosquatting, and pulling malicious packages — across the build and CI/CD dependency chain.",
8052
+ "misses": [
8053
+ "Focuses on package-manager dependency resolution; under-specifies CI/CD ACTION references, where the dominant documented usage pins by mutable tag and a repointed tag silently substitutes code (tj-actions/changed-files).",
8054
+ "Does not address transitive action inclusion: a consumer can correctly SHA-pin an action that itself references a malicious dependency by mutable tag, so consumer-side pinning is defeated one tier down (reviewdog/action-setup).",
8055
+ "Stops at the CI pipeline; the same dependency-chain abuse on the developer endpoint — a trojanized IDE extension that harvests the credentials the pipeline protects — is upstream of every CI/CD control (Nx Console)."
8056
+ ],
8057
+ "real_requirement": "Dependency-chain controls must require full commit-SHA pinning for all CI/CD actions AND verification that transitively-included actions are themselves SHA-pinned (any tag-referenced link in the chain renders the whole chain unpinned). The control must extend to developer-endpoint dependency surfaces (IDE extensions) since they hold the same secrets as the pipeline.",
8058
+ "status": "open",
8059
+ "opened_date": "2026-05-28",
8060
+ "evidence_cves": [
8061
+ "CVE-2025-30066",
8062
+ "CVE-2025-30154",
8063
+ "CVE-2026-48027"
8064
+ ],
8065
+ "atlas_refs": [
8066
+ "AML.T0010"
8067
+ ],
8068
+ "attack_refs": [
8069
+ "T1195",
8070
+ "T1195.001"
8071
+ ],
8072
+ "theater_test": {
8073
+ "claim": "We mitigate CI/CD dependency-chain abuse per OWASP CICD-SEC-3.",
8074
+ "test": "Pull the dependency-chain controls. Confirm they enforce full commit-SHA pinning for every third-party CI/CD action AND verify that those actions pin THEIR own dependencies by SHA. Sample a workflow that uses a composite/nested action; trace whether any link resolves to a mutable tag. Confirm developer IDE extensions are inventoried as a dependency surface. Theater verdict if action pinning stops at the directly-referenced action, if transitive action dependencies are unverified, or if developer-endpoint dependency surfaces are out of scope.",
8075
+ "evidence_required": [
8076
+ "enforcement check rejecting tag/branch references to third-party actions",
8077
+ "transitive-action SHA-pinning audit for nested/composite actions",
8078
+ "developer IDE-extension inventory and version-approval records"
8079
+ ],
8080
+ "verdict_when_failed": "compliance-theater"
8081
+ }
8001
8082
  }
8002
8083
  }