@blamejs/exceptd-skills 0.14.26 → 0.14.28

package/data/cwe-catalog.json

@@ -50,14 +50,14 @@
     "evidence_cves": [
       "CVE-2022-1471",
       "CVE-2024-3154",
+      "CVE-2025-10164",
       "CVE-2025-20393",
       "CVE-2025-54236",
       "CVE-2025-6558",
+      "CVE-2026-21858",
       "CVE-2026-32201",
       "CVE-2026-34197",
-      "CVE-2026-6973",
-      "CVE-2025-10164",
-      "CVE-2026-21858"
+      "CVE-2026-6973"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -104,6 +104,7 @@
       "CVE-2024-1561",
       "CVE-2024-1708",
       "CVE-2024-24591",
+      "CVE-2024-31462",
       "CVE-2024-37032",
       "CVE-2024-39722",
       "CVE-2024-57728",
@@ -111,14 +112,13 @@
       "CVE-2025-2749",
       "CVE-2025-27920",
       "CVE-2025-4632",
+      "CVE-2025-51480",
       "CVE-2025-6218",
       "CVE-2025-67818",
       "CVE-2025-8110",
-      "CVE-2026-25592",
-      "CVE-2026-34926",
       "CVE-2026-22218",
-      "CVE-2025-51480",
-      "CVE-2024-31462"
+      "CVE-2026-25592",
+      "CVE-2026-34926"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-AC-3",
@@ -155,6 +155,7 @@
       "CVE-2016-10033",
       "CVE-2020-25079",
       "CVE-2023-33538",
+      "CVE-2024-12450",
       "CVE-2024-5565",
       "CVE-2025-10035",
       "CVE-2025-29635",
@@ -169,8 +170,7 @@
       "CVE-2026-30617",
       "CVE-2026-30624",
       "CVE-2026-30625",
-      "MAL-2026-3083",
-      "CVE-2024-12450"
+      "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -421,15 +421,15 @@
       "CVE-2026-1281",
       "CVE-2026-1340",
       "CVE-2026-20045",
+      "CVE-2026-21877",
       "CVE-2026-25592",
       "CVE-2026-30615",
       "CVE-2026-33017",
       "CVE-2026-34197",
       "CVE-2026-45829",
-      "CVE-2026-6973",
-      "MAL-2026-3083",
       "CVE-2026-5760",
-      "CVE-2026-21877"
+      "CVE-2026-6973",
+      "MAL-2026-3083"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -1283,6 +1283,7 @@
       "CVE-2024-7399",
       "CVE-2024-7694",
       "CVE-2025-2749",
+      "CVE-2025-31324",
       "CVE-2025-52691",
       "CVE-2026-21877"
     ],
@@ -1361,6 +1362,7 @@
       "CVE-2024-50050",
       "CVE-2024-8069",
       "CVE-2025-10035",
+      "CVE-2025-10164",
       "CVE-2025-23254",
       "CVE-2025-24016",
       "CVE-2025-26399",
@@ -1377,14 +1379,13 @@
       "CVE-2025-59287",
       "CVE-2025-60455",
       "CVE-2025-68664",
+      "CVE-2025-68665",
       "CVE-2025-8747",
       "CVE-2026-20131",
       "CVE-2026-20963",
-      "CVE-2026-31229",
-      "CVE-2025-68665",
-      "CVE-2025-10164",
       "CVE-2026-3059",
-      "CVE-2026-3060"
+      "CVE-2026-3060",
+      "CVE-2026-31229"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -1414,10 +1415,13 @@
     "skills_referencing": [],
     "evidence_cves": [
       "CVE-2024-3094",
+      "CVE-2025-30066",
+      "CVE-2025-30154",
       "CVE-2025-54313",
       "CVE-2025-59374",
       "CVE-2026-33634",
       "CVE-2026-45321",
+      "CVE-2026-48027",
       "MAL-2026-3083",
       "MAL-2026-NODE-IPC-STEALER",
       "MAL-2026-SHAI-HULUD-OSS",
@@ -1654,10 +1658,12 @@
       "CVE-2024-21762",
       "CVE-2024-37079",
       "CVE-2024-42479",
+      "CVE-2025-0282",
       "CVE-2025-14174",
       "CVE-2025-14733",
       "CVE-2025-21042",
       "CVE-2025-21043",
+      "CVE-2025-22457",
       "CVE-2025-5419",
       "CVE-2025-6965",
       "CVE-2025-9242",
@@ -1895,11 +1901,11 @@
       "CVE-2023-43654",
       "CVE-2023-48022",
       "CVE-2023-51449",
+      "CVE-2024-12450",
       "CVE-2024-6587",
       "CVE-2025-25297",
       "CVE-2025-56520",
       "CVE-2025-61884",
-      "CVE-2024-12450",
       "CVE-2026-22219"
     ],
     "framework_controls_partially_addressing": [
@@ -2202,9 +2208,9 @@
       "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
       "CVE-2025-3466",
       "CVE-2025-40536",
+      "CVE-2025-68668",
       "CVE-2026-21510",
-      "CVE-2026-21513",
-      "CVE-2025-68668"
+      "CVE-2026-21513"
     ],
     "last_verified": "2026-05-18",
     "notes": "Added v0.13.17 to back the UnDefend Defender update-disruption entry. CWE-693 is the canonical parent for failures-of-protection-mechanism — Defender continues running but its update mechanism has been corrupted, so the AV protection-mechanism fails silently while the host still passes 'is Defender running?' health checks."
@@ -2373,7 +2379,9 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2025-0282",
       "CVE-2025-20352",
+      "CVE-2025-22457",
       "CVE-2025-53521"
     ],
     "last_verified": "2026-05-18",
@@ -4433,5 +4441,31 @@
     "playbooks_referencing": [
       "identity-sso-compromise"
     ]
+  },
+  "CWE-305": {
+    "id": "CWE-305",
+    "name": "Authentication Bypass by Primary Weakness",
+    "abstraction": "Base",
+    "category": "Authentication",
+    "description": "The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-115"
+    ],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-31161"
+    ],
+    "framework_controls_partially_addressing": [
+      "NIST-800-53-IA-2",
+      "ISO-27001-2022-A.5.17"
+    ],
+    "real_requirement": "Authentication paths must be evaluated against bypass via separate primary weaknesses (e.g. header-parsing flaws, race conditions in the auth handler); fuzz and audit the auth mechanism as an integrated whole, not the algorithm in isolation.",
+    "lag_notes": "Authentication-bypass CVEs frequently stem from a primary weakness in request parsing or state handling rather than the auth algorithm itself; controls that audit only the credential-checking logic miss this class.",
+    "last_verified": "2026-05-28"
   }
 }