@blamejs/exceptd-skills 0.14.26 → 0.14.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/CHANGELOG.md +21 -0
  2. package/data/_indexes/_meta.json +10 -10
  3. package/data/_indexes/activity-feed.json +4 -4
  4. package/data/_indexes/catalog-summaries.json +9 -9
  5. package/data/_indexes/chains.json +1639 -0
  6. package/data/_indexes/frequency.json +3 -0
  7. package/data/atlas-ttps.json +29 -17
  8. package/data/attack-techniques.json +54 -37
  9. package/data/cve-catalog.json +742 -2
  10. package/data/cwe-catalog.json +53 -19
  11. package/data/framework-control-gaps.json +225 -116
  12. package/data/playbooks/framework.json +1 -0
  13. package/data/playbooks/sbom.json +1 -0
  14. package/data/zeroday-lessons.json +491 -0
  15. package/manifest.json +44 -44
  16. package/package.json +1 -1
  17. package/sbom.cdx.json +28 -28
package/data/framework-control-gaps.json CHANGED
@@ -16,7 +16,7 @@
16
16
  "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
17
17
  },
18
18
  "last_threat_review": "2026-05-15",
19
- "entry_count": 192
19
+ "entry_count": 194
20
20
  },
21
21
  "ALL-AI-PIPELINE-INTEGRITY": {
22
22
  "framework": "ALL",
@@ -52,6 +52,7 @@
52
52
  "CVE-2024-11393",
53
53
  "CVE-2024-11394",
54
54
  "CVE-2024-12366",
55
+ "CVE-2024-12450",
55
56
  "CVE-2024-12776",
56
57
  "CVE-2024-13059",
57
58
  "CVE-2024-1561",
@@ -61,6 +62,7 @@
61
62
  "CVE-2024-24591",
62
63
  "CVE-2024-27132",
63
64
  "CVE-2024-2912",
65
+ "CVE-2024-31462",
64
66
  "CVE-2024-37032",
65
67
  "CVE-2024-37052",
66
68
  "CVE-2024-37060",
@@ -72,6 +74,7 @@
72
74
  "CVE-2024-5565",
73
75
  "CVE-2024-6587",
74
76
  "CVE-2024-9526",
77
+ "CVE-2025-10164",
75
78
  "CVE-2025-1550",
76
79
  "CVE-2025-1753",
77
80
  "CVE-2025-1796",
@@ -88,14 +91,21 @@
88
91
  "CVE-2025-34291",
89
92
  "CVE-2025-3466",
90
93
  "CVE-2025-49596",
94
+ "CVE-2025-51480",
91
95
  "CVE-2025-54136",
92
96
  "CVE-2025-56520",
93
97
  "CVE-2025-60455",
94
98
  "CVE-2025-64496",
95
99
  "CVE-2025-64513",
96
100
  "CVE-2025-67818",
101
+ "CVE-2025-68668",
102
+ "CVE-2025-69286",
97
103
  "CVE-2025-8747",
98
104
  "CVE-2026-0766",
105
+ "CVE-2026-21858",
106
+ "CVE-2026-21877",
107
+ "CVE-2026-22218",
108
+ "CVE-2026-22219",
99
109
  "CVE-2026-22252",
100
110
  "CVE-2026-22688",
101
111
  "CVE-2026-24206",
@@ -105,6 +115,8 @@
105
115
  "CVE-2026-24215",
106
116
  "CVE-2026-26015",
107
117
  "CVE-2026-26190",
118
+ "CVE-2026-3059",
119
+ "CVE-2026-3060",
108
120
  "CVE-2026-30616",
109
121
  "CVE-2026-30617",
110
122
  "CVE-2026-30624",
@@ -117,19 +129,7 @@
117
129
  "CVE-2026-41947",
118
130
  "CVE-2026-41950",
119
131
  "CVE-2026-45829",
120
- "CVE-2024-12450",
121
- "CVE-2025-69286",
122
- "CVE-2026-22218",
123
- "CVE-2026-22219",
124
- "CVE-2025-51480",
125
- "CVE-2025-10164",
126
- "CVE-2026-5760",
127
- "CVE-2026-21858",
128
- "CVE-2025-68668",
129
- "CVE-2024-31462",
130
- "CVE-2026-3059",
131
- "CVE-2026-3060",
132
- "CVE-2026-21877"
132
+ "CVE-2026-5760"
133
133
  ],
134
134
  "atlas_refs": [
135
135
  "AML.T0018",
@@ -1310,28 +1310,28 @@
1310
1310
  "CVE-2024-24590",
1311
1311
  "CVE-2024-24591",
1312
1312
  "CVE-2024-2912",
1313
+ "CVE-2024-31462",
1313
1314
  "CVE-2024-37052",
1314
1315
  "CVE-2024-37060",
1315
1316
  "CVE-2024-5565",
1316
1317
  "CVE-2024-9526",
1317
1318
  "CVE-2025-0133",
1319
+ "CVE-2025-10164",
1318
1320
  "CVE-2025-1094",
1319
1321
  "CVE-2025-27520",
1320
1322
  "CVE-2025-3248",
1321
1323
  "CVE-2025-3466",
1324
+ "CVE-2025-51480",
1325
+ "CVE-2025-68668",
1322
1326
  "CVE-2025-6965",
1327
+ "CVE-2026-21858",
1328
+ "CVE-2026-21877",
1329
+ "CVE-2026-22218",
1323
1330
  "CVE-2026-30623",
1324
1331
  "CVE-2026-31229",
1325
1332
  "CVE-2026-31230",
1326
1333
  "CVE-2026-33017",
1327
- "CVE-2026-22218",
1328
- "CVE-2025-51480",
1329
- "CVE-2025-10164",
1330
- "CVE-2026-5760",
1331
- "CVE-2026-21858",
1332
- "CVE-2025-68668",
1333
- "CVE-2024-31462",
1334
- "CVE-2026-21877"
1334
+ "CVE-2026-5760"
1335
1335
  ],
1336
1336
  "atlas_refs": [
1337
1337
  "AML.T0051",
@@ -1365,7 +1365,10 @@
1365
1365
  "opened_date": "2026-04-01",
1366
1366
  "evidence_cves": [
1367
1367
  "CVE-2024-3094",
1368
+ "CVE-2025-30066",
1369
+ "CVE-2025-30154",
1368
1370
  "CVE-2026-30615",
1371
+ "CVE-2026-48027",
1369
1372
  "MAL-2024-PYPI-ULTRALYTICS-XMRIG"
1370
1373
  ],
1371
1374
  "atlas_refs": [
@@ -1504,6 +1507,7 @@
1504
1507
  "CVE-2024-7694",
1505
1508
  "CVE-2024-8068",
1506
1509
  "CVE-2024-8069",
1510
+ "CVE-2025-0282",
1507
1511
  "CVE-2025-10035",
1508
1512
  "CVE-2025-10585",
1509
1513
  "CVE-2025-11371",
@@ -1526,6 +1530,7 @@
1526
1530
  "CVE-2025-21043",
1527
1531
  "CVE-2025-21479",
1528
1532
  "CVE-2025-21480",
1533
+ "CVE-2025-22457",
1529
1534
  "CVE-2025-23254",
1530
1535
  "CVE-2025-24016",
1531
1536
  "CVE-2025-24201",
@@ -1546,7 +1551,9 @@
1546
1551
  "CVE-2025-30202",
1547
1552
  "CVE-2025-30397",
1548
1553
  "CVE-2025-31125",
1554
+ "CVE-2025-31161",
1549
1555
  "CVE-2025-31277",
1556
+ "CVE-2025-31324",
1550
1557
  "CVE-2025-32432",
1551
1558
  "CVE-2025-32433",
1552
1559
  "CVE-2025-32434",
@@ -1693,6 +1700,8 @@
1693
1700
  "CVE-2026-26015",
1694
1701
  "CVE-2026-26190",
1695
1702
  "CVE-2026-3055",
1703
+ "CVE-2026-3059",
1704
+ "CVE-2026-3060",
1696
1705
  "CVE-2026-30616",
1697
1706
  "CVE-2026-30617",
1698
1707
  "CVE-2026-30624",
@@ -1717,10 +1726,9 @@
1717
1726
  "CVE-2026-45829",
1718
1727
  "CVE-2026-46300",
1719
1728
  "CVE-2026-46333",
1729
+ "CVE-2026-48027",
1720
1730
  "CVE-2026-5281",
1721
- "CVE-2026-9082",
1722
- "CVE-2026-3059",
1723
- "CVE-2026-3060"
1731
+ "CVE-2026-9082"
1724
1732
  ],
1725
1733
  "atlas_refs": [],
1726
1734
  "attack_refs": [
@@ -2086,6 +2094,9 @@
2086
2094
  "opened_date": "2026-05-17",
2087
2095
  "evidence_cves": [
2088
2096
  "CVE-2024-3094",
2097
+ "CVE-2025-30066",
2098
+ "CVE-2025-30154",
2099
+ "CVE-2026-48027",
2089
2100
  "MAL-2026-SHAI-HULUD-OSS",
2090
2101
  "MAL-2026-TANSTACK-MINI"
2091
2102
  ],
@@ -2320,6 +2331,7 @@
2320
2331
  "CVE-2023-51449",
2321
2332
  "CVE-2023-6038",
2322
2333
  "CVE-2024-0132",
2334
+ "CVE-2024-12450",
2323
2335
  "CVE-2024-1561",
2324
2336
  "CVE-2024-21575",
2325
2337
  "CVE-2024-21576",
@@ -2332,13 +2344,12 @@
2332
2344
  "CVE-2025-32444",
2333
2345
  "CVE-2025-53767",
2334
2346
  "CVE-2025-56520",
2335
- "CVE-2026-34159",
2336
- "CVE-2026-42897",
2337
- "CVE-2024-12450",
2338
2347
  "CVE-2026-22219",
2339
- "CVE-2026-5760",
2340
2348
  "CVE-2026-3059",
2341
- "CVE-2026-3060"
2349
+ "CVE-2026-3060",
2350
+ "CVE-2026-34159",
2351
+ "CVE-2026-42897",
2352
+ "CVE-2026-5760"
2342
2353
  ],
2343
2354
  "atlas_refs": [
2344
2355
  "AML.T0096",
@@ -2413,12 +2424,14 @@
2413
2424
  "CVE-2024-11393",
2414
2425
  "CVE-2024-11394",
2415
2426
  "CVE-2024-12366",
2427
+ "CVE-2024-12450",
2416
2428
  "CVE-2024-13059",
2417
2429
  "CVE-2024-21513",
2418
2430
  "CVE-2024-24590",
2419
2431
  "CVE-2024-24591",
2420
2432
  "CVE-2024-27132",
2421
2433
  "CVE-2024-2912",
2434
+ "CVE-2024-31462",
2422
2435
  "CVE-2024-37032",
2423
2436
  "CVE-2024-37052",
2424
2437
  "CVE-2024-37060",
@@ -2427,6 +2440,7 @@
2427
2440
  "CVE-2024-5565",
2428
2441
  "CVE-2024-9526",
2429
2442
  "CVE-2025-0133",
2443
+ "CVE-2025-10164",
2430
2444
  "CVE-2025-1094",
2431
2445
  "CVE-2025-1550",
2432
2446
  "CVE-2025-1753",
@@ -2437,6 +2451,7 @@
2437
2451
  "CVE-2025-32434",
2438
2452
  "CVE-2025-33236",
2439
2453
  "CVE-2025-3466",
2454
+ "CVE-2025-51480",
2440
2455
  "CVE-2025-56520",
2441
2456
  "CVE-2025-60455",
2442
2457
  "CVE-2025-64496",
@@ -2444,6 +2459,10 @@
2444
2459
  "CVE-2025-6965",
2445
2460
  "CVE-2025-8747",
2446
2461
  "CVE-2026-0766",
2462
+ "CVE-2026-21858",
2463
+ "CVE-2026-21877",
2464
+ "CVE-2026-22218",
2465
+ "CVE-2026-22219",
2447
2466
  "CVE-2026-24213",
2448
2467
  "CVE-2026-24214",
2449
2468
  "CVE-2026-24215",
@@ -2452,16 +2471,8 @@
2452
2471
  "CVE-2026-39884",
2453
2472
  "CVE-2026-42208",
2454
2473
  "CVE-2026-45829",
2455
- "CVE-2026-9082",
2456
- "CVE-2024-12450",
2457
- "CVE-2026-22218",
2458
- "CVE-2026-22219",
2459
- "CVE-2025-51480",
2460
- "CVE-2025-10164",
2461
2474
  "CVE-2026-5760",
2462
- "CVE-2026-21858",
2463
- "CVE-2024-31462",
2464
- "CVE-2026-21877"
2475
+ "CVE-2026-9082"
2465
2476
  ],
2466
2477
  "atlas_refs": [
2467
2478
  "AML.T0053"
@@ -2638,7 +2649,9 @@
2638
2649
  "CVE-2024-7694",
2639
2650
  "CVE-2024-8068",
2640
2651
  "CVE-2024-8069",
2652
+ "CVE-2025-0282",
2641
2653
  "CVE-2025-10035",
2654
+ "CVE-2025-10164",
2642
2655
  "CVE-2025-10585",
2643
2656
  "CVE-2025-11371",
2644
2657
  "CVE-2025-11953",
@@ -2661,6 +2674,7 @@
2661
2674
  "CVE-2025-21043",
2662
2675
  "CVE-2025-21479",
2663
2676
  "CVE-2025-21480",
2677
+ "CVE-2025-22457",
2664
2678
  "CVE-2025-23254",
2665
2679
  "CVE-2025-23266",
2666
2680
  "CVE-2025-24016",
@@ -2682,7 +2696,9 @@
2682
2696
  "CVE-2025-30202",
2683
2697
  "CVE-2025-30397",
2684
2698
  "CVE-2025-31125",
2699
+ "CVE-2025-31161",
2685
2700
  "CVE-2025-31277",
2701
+ "CVE-2025-31324",
2686
2702
  "CVE-2025-32432",
2687
2703
  "CVE-2025-32433",
2688
2704
  "CVE-2025-32434",
@@ -2835,6 +2851,8 @@
2835
2851
  "CVE-2026-26015",
2836
2852
  "CVE-2026-26190",
2837
2853
  "CVE-2026-3055",
2854
+ "CVE-2026-3059",
2855
+ "CVE-2026-3060",
2838
2856
  "CVE-2026-30616",
2839
2857
  "CVE-2026-30617",
2840
2858
  "CVE-2026-30624",
@@ -2868,10 +2886,7 @@
2868
2886
  "CVE-2026-46333",
2869
2887
  "CVE-2026-5281",
2870
2888
  "CVE-2026-6973",
2871
- "CVE-2026-9082",
2872
- "CVE-2025-10164",
2873
- "CVE-2026-3059",
2874
- "CVE-2026-3060"
2889
+ "CVE-2026-9082"
2875
2890
  ],
2876
2891
  "atlas_refs": [],
2877
2892
  "attack_refs": [
@@ -2913,12 +2928,12 @@
2913
2928
  "CVE-2025-27520",
2914
2929
  "CVE-2025-3248",
2915
2930
  "CVE-2025-3466",
2931
+ "CVE-2025-68668",
2932
+ "CVE-2026-21877",
2916
2933
  "CVE-2026-22778",
2917
2934
  "CVE-2026-32202",
2918
2935
  "CVE-2026-33017",
2919
- "CVE-2026-33825",
2920
- "CVE-2025-68668",
2921
- "CVE-2026-21877"
2936
+ "CVE-2026-33825"
2922
2937
  ],
2923
2938
  "atlas_refs": [
2924
2939
  "AML.T0017"
@@ -2956,10 +2971,11 @@
2956
2971
  "CVE-2024-3094",
2957
2972
  "CVE-2024-37052",
2958
2973
  "CVE-2024-37060",
2959
- "MAL-2026-SHAI-HULUD-OSS",
2960
- "CVE-2025-51480",
2961
2974
  "CVE-2025-10164",
2962
- "CVE-2026-5760"
2975
+ "CVE-2025-30154",
2976
+ "CVE-2025-51480",
2977
+ "CVE-2026-5760",
2978
+ "MAL-2026-SHAI-HULUD-OSS"
2963
2979
  ],
2964
2980
  "atlas_refs": [
2965
2981
  "AML.T0010"
@@ -3396,6 +3412,10 @@
3396
3412
  "evidence_cves": [
3397
3413
  "CVE-2023-3519",
3398
3414
  "CVE-2024-21762",
3415
+ "CVE-2025-0282",
3416
+ "CVE-2025-22457",
3417
+ "CVE-2025-31161",
3418
+ "CVE-2025-31324",
3399
3419
  "CVE-2025-43300",
3400
3420
  "CVE-2025-49844",
3401
3421
  "CVE-2026-31431"
@@ -3643,6 +3663,8 @@
3643
3663
  "opened_date": "2026-05-11",
3644
3664
  "evidence_cves": [
3645
3665
  "CVE-2024-3094",
3666
+ "CVE-2025-30066",
3667
+ "CVE-2025-30154",
3646
3668
  "CVE-2026-45321",
3647
3669
  "MAL-2026-3083",
3648
3670
  "MAL-2026-NODE-IPC-STEALER",
@@ -3933,12 +3955,12 @@
3933
3955
  "CVE-2024-6587",
3934
3956
  "CVE-2025-1796",
3935
3957
  "CVE-2025-64513",
3958
+ "CVE-2025-69286",
3936
3959
  "CVE-2026-24206",
3937
3960
  "CVE-2026-24207",
3938
3961
  "CVE-2026-26190",
3939
3962
  "CVE-2026-41947",
3940
- "CVE-2026-41950",
3941
- "CVE-2025-69286"
3963
+ "CVE-2026-41950"
3942
3964
  ],
3943
3965
  "atlas_refs": [
3944
3966
  "AML.T0010",
@@ -5172,6 +5194,7 @@
5172
5194
  "CVE-2024-11393",
5173
5195
  "CVE-2024-11394",
5174
5196
  "CVE-2024-12366",
5197
+ "CVE-2024-12450",
5175
5198
  "CVE-2024-12776",
5176
5199
  "CVE-2024-13059",
5177
5200
  "CVE-2024-1561",
@@ -5183,6 +5206,7 @@
5183
5206
  "CVE-2024-24591",
5184
5207
  "CVE-2024-27132",
5185
5208
  "CVE-2024-2912",
5209
+ "CVE-2024-31462",
5186
5210
  "CVE-2024-37032",
5187
5211
  "CVE-2024-37052",
5188
5212
  "CVE-2024-37060",
@@ -5194,15 +5218,20 @@
5194
5218
  "CVE-2024-5565",
5195
5219
  "CVE-2024-6587",
5196
5220
  "CVE-2024-9526",
5221
+ "CVE-2025-0282",
5222
+ "CVE-2025-10164",
5197
5223
  "CVE-2025-1550",
5198
5224
  "CVE-2025-1753",
5199
5225
  "CVE-2025-1796",
5226
+ "CVE-2025-22457",
5200
5227
  "CVE-2025-23254",
5201
5228
  "CVE-2025-23266",
5202
5229
  "CVE-2025-25297",
5203
5230
  "CVE-2025-27520",
5204
5231
  "CVE-2025-30165",
5205
5232
  "CVE-2025-30202",
5233
+ "CVE-2025-31161",
5234
+ "CVE-2025-31324",
5206
5235
  "CVE-2025-32434",
5207
5236
  "CVE-2025-32444",
5208
5237
  "CVE-2025-3248",
@@ -5210,16 +5239,23 @@
5210
5239
  "CVE-2025-34291",
5211
5240
  "CVE-2025-3466",
5212
5241
  "CVE-2025-49596",
5242
+ "CVE-2025-51480",
5213
5243
  "CVE-2025-54136",
5214
5244
  "CVE-2025-56520",
5215
5245
  "CVE-2025-60455",
5216
5246
  "CVE-2025-64496",
5217
5247
  "CVE-2025-64513",
5218
5248
  "CVE-2025-67818",
5249
+ "CVE-2025-68668",
5250
+ "CVE-2025-69286",
5219
5251
  "CVE-2025-8747",
5220
5252
  "CVE-2026-0300",
5221
5253
  "CVE-2026-0766",
5222
5254
  "CVE-2026-20182",
5255
+ "CVE-2026-21858",
5256
+ "CVE-2026-21877",
5257
+ "CVE-2026-22218",
5258
+ "CVE-2026-22219",
5223
5259
  "CVE-2026-22252",
5224
5260
  "CVE-2026-22688",
5225
5261
  "CVE-2026-24206",
@@ -5230,6 +5266,8 @@
5230
5266
  "CVE-2026-25592",
5231
5267
  "CVE-2026-26015",
5232
5268
  "CVE-2026-26190",
5269
+ "CVE-2026-3059",
5270
+ "CVE-2026-3060",
5233
5271
  "CVE-2026-30616",
5234
5272
  "CVE-2026-30617",
5235
5273
  "CVE-2026-30624",
@@ -5249,20 +5287,8 @@
5249
5287
  "CVE-2026-45829",
5250
5288
  "CVE-2026-46300",
5251
5289
  "CVE-2026-46333",
5252
- "CVE-2026-9082",
5253
- "CVE-2024-12450",
5254
- "CVE-2025-69286",
5255
- "CVE-2026-22218",
5256
- "CVE-2026-22219",
5257
- "CVE-2025-51480",
5258
- "CVE-2025-10164",
5259
5290
  "CVE-2026-5760",
5260
- "CVE-2026-21858",
5261
- "CVE-2025-68668",
5262
- "CVE-2024-31462",
5263
- "CVE-2026-3059",
5264
- "CVE-2026-3060",
5265
- "CVE-2026-21877"
5291
+ "CVE-2026-9082"
5266
5292
  ],
5267
5293
  "atlas_refs": [],
5268
5294
  "attack_refs": [
@@ -5302,23 +5328,23 @@
5302
5328
  "CVE-2023-6038",
5303
5329
  "CVE-2024-12776",
5304
5330
  "CVE-2024-1709",
5331
+ "CVE-2024-31462",
5305
5332
  "CVE-2025-1796",
5306
5333
  "CVE-2025-25297",
5307
5334
  "CVE-2025-3248",
5308
5335
  "CVE-2025-3466",
5309
5336
  "CVE-2025-56520",
5337
+ "CVE-2025-68668",
5338
+ "CVE-2025-69286",
5339
+ "CVE-2026-21858",
5340
+ "CVE-2026-21877",
5341
+ "CVE-2026-22218",
5342
+ "CVE-2026-22219",
5310
5343
  "CVE-2026-33017",
5311
5344
  "CVE-2026-39987",
5312
5345
  "CVE-2026-41947",
5313
5346
  "CVE-2026-41950",
5314
- "CVE-2026-7482",
5315
- "CVE-2025-69286",
5316
- "CVE-2026-22218",
5317
- "CVE-2026-22219",
5318
- "CVE-2026-21858",
5319
- "CVE-2025-68668",
5320
- "CVE-2024-31462",
5321
- "CVE-2026-21877"
5347
+ "CVE-2026-7482"
5322
5348
  ],
5323
5349
  "atlas_refs": [
5324
5350
  "AML.T0051"
@@ -5617,11 +5643,11 @@
5617
5643
  "CVE-2024-12776",
5618
5644
  "CVE-2025-1796",
5619
5645
  "CVE-2025-3248",
5646
+ "CVE-2025-69286",
5620
5647
  "CVE-2026-33017",
5621
5648
  "CVE-2026-41947",
5622
5649
  "CVE-2026-41950",
5623
- "CVE-2026-6973",
5624
- "CVE-2025-69286"
5650
+ "CVE-2026-6973"
5625
5651
  ],
5626
5652
  "atlas_refs": [],
5627
5653
  "attack_refs": [
@@ -5794,6 +5820,7 @@
5794
5820
  "CVE-2024-11393",
5795
5821
  "CVE-2024-11394",
5796
5822
  "CVE-2024-12366",
5823
+ "CVE-2024-12450",
5797
5824
  "CVE-2024-13059",
5798
5825
  "CVE-2024-1561",
5799
5826
  "CVE-2024-21513",
@@ -5804,6 +5831,7 @@
5804
5831
  "CVE-2024-24591",
5805
5832
  "CVE-2024-27132",
5806
5833
  "CVE-2024-2912",
5834
+ "CVE-2024-31462",
5807
5835
  "CVE-2024-37032",
5808
5836
  "CVE-2024-37052",
5809
5837
  "CVE-2024-37060",
@@ -5813,14 +5841,19 @@
5813
5841
  "CVE-2024-50050",
5814
5842
  "CVE-2024-5565",
5815
5843
  "CVE-2024-9526",
5844
+ "CVE-2025-0282",
5845
+ "CVE-2025-10164",
5816
5846
  "CVE-2025-1550",
5817
5847
  "CVE-2025-1753",
5848
+ "CVE-2025-22457",
5818
5849
  "CVE-2025-23254",
5819
5850
  "CVE-2025-23266",
5820
5851
  "CVE-2025-25297",
5821
5852
  "CVE-2025-27520",
5822
5853
  "CVE-2025-30165",
5823
5854
  "CVE-2025-30202",
5855
+ "CVE-2025-31161",
5856
+ "CVE-2025-31324",
5824
5857
  "CVE-2025-32434",
5825
5858
  "CVE-2025-32444",
5826
5859
  "CVE-2025-3248",
@@ -5828,13 +5861,19 @@
5828
5861
  "CVE-2025-34291",
5829
5862
  "CVE-2025-3466",
5830
5863
  "CVE-2025-49596",
5864
+ "CVE-2025-51480",
5831
5865
  "CVE-2025-54136",
5832
5866
  "CVE-2025-56520",
5833
5867
  "CVE-2025-60455",
5834
5868
  "CVE-2025-64496",
5835
5869
  "CVE-2025-67818",
5870
+ "CVE-2025-68668",
5836
5871
  "CVE-2025-8747",
5837
5872
  "CVE-2026-0766",
5873
+ "CVE-2026-21858",
5874
+ "CVE-2026-21877",
5875
+ "CVE-2026-22218",
5876
+ "CVE-2026-22219",
5838
5877
  "CVE-2026-22252",
5839
5878
  "CVE-2026-22688",
5840
5879
  "CVE-2026-24213",
@@ -5842,6 +5881,8 @@
5842
5881
  "CVE-2026-24215",
5843
5882
  "CVE-2026-25592",
5844
5883
  "CVE-2026-26015",
5884
+ "CVE-2026-3059",
5885
+ "CVE-2026-3060",
5845
5886
  "CVE-2026-30616",
5846
5887
  "CVE-2026-30617",
5847
5888
  "CVE-2026-30624",
@@ -5857,20 +5898,9 @@
5857
5898
  "CVE-2026-45829",
5858
5899
  "CVE-2026-46300",
5859
5900
  "CVE-2026-46333",
5860
- "CVE-2026-9082",
5861
- "MAL-2026-SHAI-HULUD-OSS",
5862
- "CVE-2024-12450",
5863
- "CVE-2026-22218",
5864
- "CVE-2026-22219",
5865
- "CVE-2025-51480",
5866
- "CVE-2025-10164",
5867
5901
  "CVE-2026-5760",
5868
- "CVE-2026-21858",
5869
- "CVE-2025-68668",
5870
- "CVE-2024-31462",
5871
- "CVE-2026-3059",
5872
- "CVE-2026-3060",
5873
- "CVE-2026-21877"
5902
+ "CVE-2026-9082",
5903
+ "MAL-2026-SHAI-HULUD-OSS"
5874
5904
  ],
5875
5905
  "atlas_refs": [],
5876
5906
  "attack_refs": [
@@ -5920,6 +5950,7 @@
5920
5950
  "CVE-2024-11393",
5921
5951
  "CVE-2024-11394",
5922
5952
  "CVE-2024-12366",
5953
+ "CVE-2024-12450",
5923
5954
  "CVE-2024-12776",
5924
5955
  "CVE-2024-13059",
5925
5956
  "CVE-2024-1561",
@@ -5931,6 +5962,7 @@
5931
5962
  "CVE-2024-24591",
5932
5963
  "CVE-2024-27132",
5933
5964
  "CVE-2024-2912",
5965
+ "CVE-2024-31462",
5934
5966
  "CVE-2024-37032",
5935
5967
  "CVE-2024-37052",
5936
5968
  "CVE-2024-37060",
@@ -5942,15 +5974,20 @@
5942
5974
  "CVE-2024-5565",
5943
5975
  "CVE-2024-6587",
5944
5976
  "CVE-2024-9526",
5977
+ "CVE-2025-0282",
5978
+ "CVE-2025-10164",
5945
5979
  "CVE-2025-1550",
5946
5980
  "CVE-2025-1753",
5947
5981
  "CVE-2025-1796",
5982
+ "CVE-2025-22457",
5948
5983
  "CVE-2025-23254",
5949
5984
  "CVE-2025-23266",
5950
5985
  "CVE-2025-25297",
5951
5986
  "CVE-2025-27520",
5952
5987
  "CVE-2025-30165",
5953
5988
  "CVE-2025-30202",
5989
+ "CVE-2025-31161",
5990
+ "CVE-2025-31324",
5954
5991
  "CVE-2025-32434",
5955
5992
  "CVE-2025-32444",
5956
5993
  "CVE-2025-3248",
@@ -5958,14 +5995,21 @@
5958
5995
  "CVE-2025-34291",
5959
5996
  "CVE-2025-3466",
5960
5997
  "CVE-2025-49596",
5998
+ "CVE-2025-51480",
5961
5999
  "CVE-2025-54136",
5962
6000
  "CVE-2025-56520",
5963
6001
  "CVE-2025-60455",
5964
6002
  "CVE-2025-64496",
5965
6003
  "CVE-2025-64513",
5966
6004
  "CVE-2025-67818",
6005
+ "CVE-2025-68668",
6006
+ "CVE-2025-69286",
5967
6007
  "CVE-2025-8747",
5968
6008
  "CVE-2026-0766",
6009
+ "CVE-2026-21858",
6010
+ "CVE-2026-21877",
6011
+ "CVE-2026-22218",
6012
+ "CVE-2026-22219",
5969
6013
  "CVE-2026-22252",
5970
6014
  "CVE-2026-22688",
5971
6015
  "CVE-2026-24206",
@@ -5976,6 +6020,8 @@
5976
6020
  "CVE-2026-25592",
5977
6021
  "CVE-2026-26015",
5978
6022
  "CVE-2026-26190",
6023
+ "CVE-2026-3059",
6024
+ "CVE-2026-3060",
5979
6025
  "CVE-2026-30616",
5980
6026
  "CVE-2026-30617",
5981
6027
  "CVE-2026-30624",
@@ -5993,20 +6039,8 @@
5993
6039
  "CVE-2026-45829",
5994
6040
  "CVE-2026-46300",
5995
6041
  "CVE-2026-46333",
5996
- "CVE-2026-9082",
5997
- "CVE-2024-12450",
5998
- "CVE-2025-69286",
5999
- "CVE-2026-22218",
6000
- "CVE-2026-22219",
6001
- "CVE-2025-51480",
6002
- "CVE-2025-10164",
6003
6042
  "CVE-2026-5760",
6004
- "CVE-2026-21858",
6005
- "CVE-2025-68668",
6006
- "CVE-2024-31462",
6007
- "CVE-2026-3059",
6008
- "CVE-2026-3060",
6009
- "CVE-2026-21877"
6043
+ "CVE-2026-9082"
6010
6044
  ],
6011
6045
  "atlas_refs": [],
6012
6046
  "attack_refs": [
@@ -6309,13 +6343,13 @@
6309
6343
  "CVE-2025-3248",
6310
6344
  "CVE-2025-64513",
6311
6345
  "CVE-2025-67818",
6346
+ "CVE-2025-69286",
6312
6347
  "CVE-2026-20182",
6313
6348
  "CVE-2026-24206",
6314
6349
  "CVE-2026-24207",
6315
6350
  "CVE-2026-26190",
6316
6351
  "CVE-2026-33017",
6317
- "CVE-2026-45829",
6318
- "CVE-2025-69286"
6352
+ "CVE-2026-45829"
6319
6353
  ],
6320
6354
  "atlas_refs": [],
6321
6355
  "attack_refs": [
@@ -6351,8 +6385,8 @@
6351
6385
  "CVE-2023-43472",
6352
6386
  "CVE-2025-55319",
6353
6387
  "CVE-2025-68664",
6354
- "CVE-2026-30623",
6355
- "CVE-2025-68665"
6388
+ "CVE-2025-68665",
6389
+ "CVE-2026-30623"
6356
6390
  ],
6357
6391
  "atlas_refs": [
6358
6392
  "AML.T0010",
@@ -6425,22 +6459,26 @@
6425
6459
  "opened_date": "2026-05-18",
6426
6460
  "evidence_cves": [
6427
6461
  "CVE-2022-36551",
6462
+ "CVE-2024-12450",
6428
6463
  "CVE-2024-21762",
6464
+ "CVE-2024-31462",
6465
+ "CVE-2025-0282",
6466
+ "CVE-2025-10164",
6467
+ "CVE-2025-22457",
6429
6468
  "CVE-2025-25297",
6469
+ "CVE-2025-31161",
6470
+ "CVE-2025-31324",
6471
+ "CVE-2025-51480",
6430
6472
  "CVE-2025-56520",
6473
+ "CVE-2025-68668",
6431
6474
  "CVE-2026-20182",
6432
- "CVE-2024-12450",
6475
+ "CVE-2026-21858",
6476
+ "CVE-2026-21877",
6433
6477
  "CVE-2026-22218",
6434
6478
  "CVE-2026-22219",
6435
- "CVE-2025-51480",
6436
- "CVE-2025-10164",
6437
- "CVE-2026-5760",
6438
- "CVE-2026-21858",
6439
- "CVE-2025-68668",
6440
- "CVE-2024-31462",
6441
6479
  "CVE-2026-3059",
6442
6480
  "CVE-2026-3060",
6443
- "CVE-2026-21877"
6481
+ "CVE-2026-5760"
6444
6482
  ],
6445
6483
  "atlas_refs": [],
6446
6484
  "attack_refs": [
@@ -6666,10 +6704,10 @@
6666
6704
  "CVE-2025-55319",
6667
6705
  "CVE-2025-59529",
6668
6706
  "CVE-2025-68664",
6707
+ "CVE-2025-68665",
6669
6708
  "CVE-2025-6965",
6670
6709
  "CVE-2026-22778",
6671
- "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP",
6672
- "CVE-2025-68665"
6710
+ "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
6673
6711
  ],
6674
6712
  "theater_test": {
6675
6713
  "claim": "We are compliant with Art-15 (Accuracy, robustness, and cybersecurity of high-risk AI systems) because we follow the documented requirement: Article 15 — high-risk AI systems must be designed and developed so as to achieve an appropriate level of accuracy, robustness, and cybersecurity throughout their lifecycle. Anchored on the assumption",
@@ -7248,9 +7286,9 @@
7248
7286
  "status": "open",
7249
7287
  "opened_at": "2026-05-18",
7250
7288
  "evidence_cves": [
7289
+ "CVE-2024-12450",
7251
7290
  "CVE-2025-22224",
7252
- "CVE-2025-22225",
7253
- "CVE-2024-12450"
7291
+ "CVE-2025-22225"
7254
7292
  ],
7255
7293
  "theater_test": {
7256
7294
  "claim": "We are compliant with A.8.21 (Security of network services) because we follow the documented requirement: Annex A.8.21 — identifying, implementing, and monitoring security mechanisms, service levels, and management requirements for network services. Anchored on segmentation, secure protocols, and service-",
@@ -7998,5 +8036,76 @@
7998
8036
  ],
7999
8037
  "verdict_when_failed": "compliance-theater"
8000
8038
  }
8039
+ },
8040
+ "NIST-800-53-SR-11": {
8041
+ "framework": "NIST SP 800-53 Rev 5",
8042
+ "control_id": "SR-11",
8043
+ "control_name": "Component Authenticity",
8044
+ "designed_for": "Develop and implement anti-counterfeit policy and procedures; detect and report counterfeit or tampered system components; train personnel to recognize them. Framed around hardware/firmware counterfeiting and tamper-evident packaging in a procurement supply chain — authenticity is established by confirming the component came from the genuine vendor.",
8045
+ "misses": [
8046
+ "Equates authenticity with publisher identity. A GitHub Action whose mutable tag is repointed to malicious code, or an IDE extension published as a malicious version under the legitimate publisher account, is 'authentic' by SR-11's vendor-identity test yet fully malicious — authenticity of the principal is necessary but not sufficient when the principal or its release channel is compromised.",
8047
+ "Software artifacts distributed via registries and marketplaces (npm, PyPI, VS Code Marketplace, OpenVSX, GitHub Actions) carry no consumer-verifiable cryptographic provenance by default; SR-11's counterfeit-detection model has no artifact-level integrity check to apply.",
8048
+ "Mutable references (git tags, 'latest' marketplace versions) mean the same identifier resolves to different bytes over time; SR-11 has no concept of binding an authentic component to an immutable revision."
8049
+ ],
8050
+ "real_requirement": "SR-11 implementations for software components must require artifact-level cryptographic provenance, not publisher identity alone: full commit-SHA pinning for CI/CD actions, signed-and-verified IDE extension publishing, and build provenance attestations (sigstore / in-toto / SLSA) verified at install time. The control must explicitly treat 'authentic publisher, malicious payload' as an authenticity failure and require detection of release-channel compromise (repointed tags, anomalous marketplace publications).",
8051
+ "status": "open",
8052
+ "opened_date": "2026-05-28",
8053
+ "evidence_cves": [
8054
+ "CVE-2025-30066",
8055
+ "CVE-2026-48027"
8056
+ ],
8057
+ "atlas_refs": [
8058
+ "AML.T0010"
8059
+ ],
8060
+ "attack_refs": [
8061
+ "T1195",
8062
+ "T1195.001"
8063
+ ],
8064
+ "theater_test": {
8065
+ "claim": "Our components are authenticity-verified per NIST 800-53 SR-11.",
8066
+ "test": "Pull the SR-11 authenticity evidence for software components. Confirm it requires artifact-level provenance — full commit-SHA pinning for every third-party CI/CD action, signature verification for IDE extensions, and verified build-provenance attestations — rather than 'the artifact came from the genuine publisher account'. Sample a recent release-channel-compromise case (tj-actions tag repointing or the Nx Console marketplace compromise); verify the SR-11 procedure would have flagged an authentic-publisher malicious artifact. Theater verdict if authenticity is established by publisher identity alone with no immutable artifact binding.",
8067
+ "evidence_required": [
8068
+ "policy mandating commit-SHA pinning for CI/CD actions with an enforcement check",
8069
+ "IDE-extension signature/version verification records for managed developer hosts",
8070
+ "build-provenance (SLSA / sigstore / in-toto) verification logs at install/deploy time"
8071
+ ],
8072
+ "verdict_when_failed": "compliance-theater"
8073
+ }
8074
+ },
8075
+ "OWASP-CICD-SEC-3": {
8076
+ "framework": "OWASP Top 10 CI/CD Security Risks",
8077
+ "control_id": "CICD-SEC-3",
8078
+ "control_name": "Dependency Chain Abuse",
8079
+ "designed_for": "Prevent abuse of the dependency-resolution mechanism — dependency confusion, typosquatting, and pulling malicious packages — across the build and CI/CD dependency chain.",
8080
+ "misses": [
8081
+ "Focuses on package-manager dependency resolution; under-specifies CI/CD ACTION references, where the dominant documented usage pins by mutable tag and a repointed tag silently substitutes code (tj-actions/changed-files).",
8082
+ "Does not address transitive action inclusion: a consumer can correctly SHA-pin an action that itself references a malicious dependency by mutable tag, so consumer-side pinning is defeated one tier down (reviewdog/action-setup).",
8083
+ "Stops at the CI pipeline; the same dependency-chain abuse on the developer endpoint — a trojanized IDE extension that harvests the credentials the pipeline protects — is upstream of every CI/CD control (Nx Console)."
8084
+ ],
8085
+ "real_requirement": "Dependency-chain controls must require full commit-SHA pinning for all CI/CD actions AND verification that transitively-included actions are themselves SHA-pinned (any tag-referenced link in the chain renders the whole chain unpinned). The control must extend to developer-endpoint dependency surfaces (IDE extensions) since they hold the same secrets as the pipeline.",
8086
+ "status": "open",
8087
+ "opened_date": "2026-05-28",
8088
+ "evidence_cves": [
8089
+ "CVE-2025-30066",
8090
+ "CVE-2025-30154",
8091
+ "CVE-2026-48027"
8092
+ ],
8093
+ "atlas_refs": [
8094
+ "AML.T0010"
8095
+ ],
8096
+ "attack_refs": [
8097
+ "T1195",
8098
+ "T1195.001"
8099
+ ],
8100
+ "theater_test": {
8101
+ "claim": "We mitigate CI/CD dependency-chain abuse per OWASP CICD-SEC-3.",
8102
+ "test": "Pull the dependency-chain controls. Confirm they enforce full commit-SHA pinning for every third-party CI/CD action AND verify that those actions pin THEIR own dependencies by SHA. Sample a workflow that uses a composite/nested action; trace whether any link resolves to a mutable tag. Confirm developer IDE extensions are inventoried as a dependency surface. Theater verdict if action pinning stops at the directly-referenced action, if transitive action dependencies are unverified, or if developer-endpoint dependency surfaces are out of scope.",
8103
+ "evidence_required": [
8104
+ "enforcement check rejecting tag/branch references to third-party actions",
8105
+ "transitive-action SHA-pinning audit for nested/composite actions",
8106
+ "developer IDE-extension inventory and version-approval records"
8107
+ ],
8108
+ "verdict_when_failed": "compliance-theater"
8109
+ }
8001
8110
  }
8002
8111
  }