@blamejs/exceptd-skills 0.15.15 → 0.15.17

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.17 — 2026-05-29
+
+Draft-curation pass 15 — Chromium browser zero-days. Five CISA KEV-listed Google Chromium client-side CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: V8 JavaScript engine flaws (CVE-2025-13223 and CVE-2025-6554 type confusion, CVE-2025-5419 out-of-bounds read/write), a CSS use-after-free (CVE-2026-2441), and an ANGLE/GPU sandbox escape (CVE-2025-6558). All map T1203 (Exploitation for Client Execution); the sandbox-escape entry also maps T1068. The lessons stress same-day Chrome component-updater rollout — not gating browser updates behind a managed change window — as the load-bearing control, since these are weaponized within days in targeted-spyware and watering-hole chains.
+
+## 0.15.16 — 2026-05-29
+
+Draft-curation pass 14 — web-application server-side RCE. Eight CISA KEV-listed unauthenticated web-app CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Kentico Xperience CMS (CVE-2025-2749 path-traversal + file upload, CVE-2025-2746 and CVE-2025-2747 alternate-channel authentication bypasses), Craft CMS code injection (CVE-2025-32432 and the related CVE-2024-56145), Roundcube Webmail deserialization (CVE-2025-49113), and SolarWinds Web Help Desk deserialization (CVE-2025-26399, CVE-2025-40551). All map T1190, with per-class T1059 (code injection / deserialization), T1078 (auth bypass), or T1505.003 (upload → web shell). The lessons stress web-shell hunting and application-secret rotation as required cleanup beyond the patch.
+
 ## 0.15.15 — 2026-05-29
 
 Draft-curation pass 13 — Windows kernel/driver LPE. Seven CISA KEV-listed Windows local-privilege-escalation CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: a Common Log File System (CLFS) driver use-after-free (CVE-2025-32701 — CLFS is a recurring kernel-LPE target), a race condition (CVE-2025-62215), an untrusted-pointer dereference (CVE-2025-24990), link-following (CVE-2025-60710), a kernel out-of-bounds read primitive (CVE-2023-36424), an information-disclosure primitive (CVE-2026-20805), and improper privilege management (CVE-2021-43226). All map T1068 (Exploitation for Privilege Escalation). The lessons frame these as the second half of the ransomware chain (initial access → unpatched LPE → SYSTEM within hours) and stress hypervisor-protected code integrity (HVCI/VBS) and the Microsoft Vulnerable Driver Blocklist as load-bearing endpoint controls beyond the patch.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-29T21:03:43.254Z",
+  "generated_at": "2026-05-29T21:56:30.516Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "4583ef83386e42795c8990101aaad4526d7965db5c29cabb4899d8b4d807a3ca",
+    "manifest.json": "ba250dd43d47c33983c364d62fb14e3e02b7ab9f693bac3fee7999aa532ff0cb",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "8a593b6a67125e0eb4e5d167654b5fc24531ca2f95be4362a1c4d80e3df2d3a3",
-    "data/cve-catalog.json": "a97c16dbf941e68e2e0fda7a82d821e64952eb224170e48dfbd2c5a2af61999d",
+    "data/attack-techniques.json": "f3827a7bef7ec2241a50822490c1cfc68228be63e526389219d14416a6be3c0c",
+    "data/cve-catalog.json": "093c774e39e93dc597350df97c556a9204dec1cedce0c22f28fd1bf4506b6fc2",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "23155c21ee4dd4e7a6402cd4215f266dae559892b3f317e43fac9f64f4a10ef2",
+    "data/zeroday-lessons.json": "da860282700942b7766778ec499a56011c822206758bc42cd4c20ae12e285d74",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -298,6 +298,7 @@
       "CVE-2024-4889",
       "CVE-2024-50050",
       "CVE-2024-5565",
+      "CVE-2024-56145",
       "CVE-2024-8069",
       "CVE-2025-10164",
       "CVE-2025-1094",
@@ -307,16 +308,20 @@
       "CVE-2025-20281",
       "CVE-2025-20337",
       "CVE-2025-23254",
+      "CVE-2025-26399",
       "CVE-2025-27520",
       "CVE-2025-29635",
       "CVE-2025-30165",
+      "CVE-2025-32432",
       "CVE-2025-32434",
       "CVE-2025-32444",
       "CVE-2025-3248",
       "CVE-2025-33236",
       "CVE-2025-34291",
       "CVE-2025-3466",
+      "CVE-2025-40551",
       "CVE-2025-4428",
+      "CVE-2025-49113",
       "CVE-2025-49596",
       "CVE-2025-49704",
       "CVE-2025-51480",
@@ -500,6 +505,7 @@
       "CVE-2025-60710",
       "CVE-2025-62215",
       "CVE-2025-62849",
+      "CVE-2025-6558",
       "CVE-2026-0300",
       "CVE-2026-20122",
       "CVE-2026-20805",
@@ -971,7 +977,6 @@
       "CVE-2025-11953",
       "CVE-2025-12480",
       "CVE-2025-12686",
-      "CVE-2025-13223",
       "CVE-2025-14611",
       "CVE-2025-14733",
       "CVE-2025-14847",
@@ -991,6 +996,9 @@
       "CVE-2025-25257",
       "CVE-2025-25297",
       "CVE-2025-26399",
+      "CVE-2025-2746",
+      "CVE-2025-2747",
+      "CVE-2025-2749",
       "CVE-2025-27520",
       "CVE-2025-2775",
       "CVE-2025-2776",
@@ -1073,8 +1081,6 @@
       "CVE-2025-64496",
       "CVE-2025-64513",
       "CVE-2025-6543",
-      "CVE-2025-6554",
-      "CVE-2025-6558",
       "CVE-2025-66376",
       "CVE-2025-66644",
       "CVE-2025-67818",
@@ -1316,6 +1322,7 @@
       "CVE-2023-41974",
       "CVE-2023-43000",
       "CVE-2025-10585",
+      "CVE-2025-13223",
       "CVE-2025-14174",
       "CVE-2025-21479",
       "CVE-2025-21480",
@@ -1329,6 +1336,9 @@
       "CVE-2025-43520",
       "CVE-2025-43529",
       "CVE-2025-4919",
+      "CVE-2025-5419",
+      "CVE-2025-6554",
+      "CVE-2025-6558",
       "CVE-2026-20700",
       "CVE-2026-21385",
       "CVE-2026-2441",
@@ -12071,6 +12081,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2025-2749",
       "CVE-2025-31324",
       "CVE-2025-49704",
       "CVE-2025-53770"