@blamejs/exceptd-skills 0.15.17 → 0.15.19

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.19 — 2026-05-29
+
+Draft-curation pass 17 — enterprise server-side applications. Eight CISA KEV-listed unauthenticated CVEs across manufacturing-operations, file-sharing, and remote-management software are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Dassault Systèmes DELMIA Apriso (CVE-2025-6204 code injection, CVE-2025-5086 deserialization, CVE-2025-6205 missing authorization), Gladinet CentreStack/Triofox (CVE-2025-14611 hard-coded cryptographic key, CVE-2025-11371 file disclosure leaking the machine key, CVE-2025-12480 improper access control), and ConnectWise ScreenConnect (CVE-2024-1708 path traversal, CVE-2025-3935 authentication bypass). All map T1190, with per-class T1059, T1078, T1552 (key disclosure/forgery), or T1505.003. The lessons stress that key-disclosure and authentication-bypass flaws require cryptographic-key rotation — not just patching — and that RMM/file-sharing/MES compromise extends the blast radius to downstream and OT-adjacent systems.
+
+## 0.15.18 — 2026-05-29
+
+Draft-curation pass 16 — non-Windows kernel/driver LPE. Seven CISA KEV-listed local-privilege-escalation CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Qualcomm Adreno GPU / chipset flaws (CVE-2026-21385 integer overflow, CVE-2025-21479 and CVE-2025-21480 incorrect-authorization GPU flaws used in Android targeted chains, CVE-2025-27038 use-after-free) and Linux kernel flaws (CVE-2018-14634 "Mutagen Astronomy" integer overflow, CVE-2021-22555 netfilter heap out-of-bounds write, CVE-2023-0386 OverlayFS ownership). All map T1068 (Exploitation for Privilege Escalation). The lessons give platform-correct remediation — Android Security Bulletin OTA updates and MDM-enforced SLAs for the chipset entries, distribution kernel updates or live-patching plus kernel hardening for the Linux entries — and frame these as the escalation half of the attack chain.
+
 ## 0.15.17 — 2026-05-29
 
 Draft-curation pass 15 — Chromium browser zero-days. Five CISA KEV-listed Google Chromium client-side CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: V8 JavaScript engine flaws (CVE-2025-13223 and CVE-2025-6554 type confusion, CVE-2025-5419 out-of-bounds read/write), a CSS use-after-free (CVE-2026-2441), and an ANGLE/GPU sandbox escape (CVE-2025-6558). All map T1203 (Exploitation for Client Execution); the sandbox-escape entry also maps T1068. The lessons stress same-day Chrome component-updater rollout — not gating browser updates behind a managed change window — as the load-bearing control, since these are weaponized within days in targeted-spyware and watering-hole chains.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-29T21:56:30.516Z",
+  "generated_at": "2026-05-29T22:34:17.490Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "ba250dd43d47c33983c364d62fb14e3e02b7ab9f693bac3fee7999aa532ff0cb",
+    "manifest.json": "f4ca112722a595daef5938c0815358502506f83f15c035e3c7be3298d5d3badb",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "f3827a7bef7ec2241a50822490c1cfc68228be63e526389219d14416a6be3c0c",
-    "data/cve-catalog.json": "093c774e39e93dc597350df97c556a9204dec1cedce0c22f28fd1bf4506b6fc2",
+    "data/attack-techniques.json": "abb27bf3358a35d4e955bd133244bccdf64f633681b62f0714ec8ecfe1595261",
+    "data/cve-catalog.json": "9b096af370a99c08ddbfe79285793a8d5d86b995c453361dd89e15511ec9feeb",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "da860282700942b7766778ec499a56011c822206758bc42cd4c20ae12e285d74",
+    "data/zeroday-lessons.json": "99bb6d869f97f52f726ebc50e3fa8c787824212b129e4903fb18a9c46a57b017",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -324,12 +324,14 @@
       "CVE-2025-49113",
       "CVE-2025-49596",
       "CVE-2025-49704",
+      "CVE-2025-5086",
       "CVE-2025-51480",
       "CVE-2025-53773",
       "CVE-2025-54136",
       "CVE-2025-55319",
       "CVE-2025-58034",
       "CVE-2025-60455",
+      "CVE-2025-6204",
       "CVE-2025-64496",
       "CVE-2025-68645",
       "CVE-2025-68664",
@@ -482,19 +484,25 @@
     "version": "v19",
     "cve_refs": [
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
+      "CVE-2018-14634",
       "CVE-2020-17103-REREGRESSION-2026",
+      "CVE-2021-22555",
       "CVE-2021-30952",
       "CVE-2021-43226",
+      "CVE-2023-0386",
       "CVE-2023-36424",
       "CVE-2023-41974",
       "CVE-2023-43000",
       "CVE-2024-0769",
       "CVE-2024-8068",
       "CVE-2025-10725",
+      "CVE-2025-21479",
+      "CVE-2025-21480",
       "CVE-2025-22224",
       "CVE-2025-22225",
       "CVE-2025-24201",
       "CVE-2025-24990",
+      "CVE-2025-27038",
       "CVE-2025-31277",
       "CVE-2025-32701",
       "CVE-2025-38352",
@@ -509,6 +517,7 @@
       "CVE-2026-0300",
       "CVE-2026-20122",
       "CVE-2026-20805",
+      "CVE-2026-21385",
       "CVE-2026-31431",
       "CVE-2026-31635",
       "CVE-2026-33825",
@@ -573,6 +582,7 @@
       "CVE-2024-12776",
       "CVE-2024-1709",
       "CVE-2024-54085",
+      "CVE-2025-12480",
       "CVE-2025-1796",
       "CVE-2025-21085",
       "CVE-2025-2746",
@@ -580,9 +590,11 @@
       "CVE-2025-31161",
       "CVE-2025-32975",
       "CVE-2025-34026",
+      "CVE-2025-3935",
       "CVE-2025-4427",
       "CVE-2025-49706",
       "CVE-2025-61757",
+      "CVE-2025-6205",
       "CVE-2025-64513",
       "CVE-2025-69286",
       "CVE-2026-1603",
@@ -928,7 +940,6 @@
       "CVE-2022-36551",
       "CVE-2022-37055",
       "CVE-2022-40799",
-      "CVE-2023-0386",
       "CVE-2023-21529",
       "CVE-2023-2533",
       "CVE-2023-33538",
@@ -949,6 +960,7 @@
       "CVE-2024-12987",
       "CVE-2024-13059",
       "CVE-2024-1561",
+      "CVE-2024-1708",
       "CVE-2024-1709",
       "CVE-2024-21575",
       "CVE-2024-21576",
@@ -1314,9 +1326,7 @@
       "CVE-2011-3402",
       "CVE-2013-3918",
       "CVE-2014-3931",
-      "CVE-2018-14634",
       "CVE-2020-9715",
-      "CVE-2021-22555",
       "CVE-2021-30952",
       "CVE-2022-48503",
       "CVE-2023-41974",
@@ -1324,10 +1334,7 @@
       "CVE-2025-10585",
       "CVE-2025-13223",
       "CVE-2025-14174",
-      "CVE-2025-21479",
-      "CVE-2025-21480",
       "CVE-2025-24201",
-      "CVE-2025-27038",
       "CVE-2025-31277",
       "CVE-2025-32709",
       "CVE-2025-43200",
@@ -1340,7 +1347,6 @@
       "CVE-2025-6554",
       "CVE-2025-6558",
       "CVE-2026-20700",
-      "CVE-2026-21385",
       "CVE-2026-2441",
       "CVE-2026-25592",
       "CVE-2026-34621",
@@ -1671,6 +1677,8 @@
     "cve_refs": [
       "CVE-2023-47117",
       "CVE-2024-12450",
+      "CVE-2025-11371",
+      "CVE-2025-14611",
       "CVE-2025-30066",
       "CVE-2025-30154",
       "CVE-2025-5777",
@@ -12081,6 +12089,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2024-1708",
       "CVE-2025-2749",
       "CVE-2025-31324",
       "CVE-2025-49704",