@blamejs/exceptd-skills 0.15.3 → 0.15.5

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.15.5 — 2026-05-29
+
+Draft-curation pass 3 — the client-side memory-corruption class. Four CISA KEV-listed browser/document-reader RCEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, a matching zero-day lesson, and ATT&CK enrichment to T1203 (Exploitation for Client Execution) rather than the network-service T1190: Google Chrome Skia out-of-bounds write (CVE-2026-3909), Chrome Dawn/WebGPU use-after-free (CVE-2026-5281), Chrome V8 memory-buffer flaw (CVE-2026-3910), and Adobe Acrobat/Reader prototype pollution (CVE-2026-34621). The lessons frame remediation as endpoint/browser patch-SLA (same-day auto-update vs. managed change windows) rather than perimeter patching.
+
+## 0.15.4 — 2026-05-29
+
+Draft-curation pass 2. Eight more CISA KEV-listed CVEs are promoted from auto-imported drafts to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons — the network-service authentication-bypass and code-injection class: Ivanti EPMM (CVE-2026-1281), SmarterTools SmarterMail auth bypass (CVE-2026-23760) and missing-auth (CVE-2026-24423), Cisco Unified Communications code injection (CVE-2026-20045), cPanel & WHM / WP2 missing authentication (CVE-2026-41940), Ivanti EPM authentication bypass (CVE-2026-1603), Cisco Catalyst SD-WAN improper authentication (CVE-2026-20127), and Fortinet multi-product authentication bypass (CVE-2026-24858).
+
+The catalog-gap `temporal-staleness` class no longer counts a passed CISA KEV due-date. That date is a fixed external operator-remediation deadline, not a measure of whether a catalog entry's data is current — every historical KEV entry's due-date passes by calendar. The class now reflects only maintainer-controllable data-freshness (source verification, last-updated, and EPSS recency), so `exceptd`'s gap audit no longer reports every aged KEV entry as stale.
+
 ## 0.15.3 — 2026-05-29
 
 Draft-curation pass (1 of an ongoing series). Eight CISA KEV-listed CVE entries that were carried as auto-imported drafts are promoted to fully-curated entries with behavioral IOCs, ATT&CK enrichment, and matching zero-day lessons: Apache ActiveMQ (CVE-2026-34197), Microsoft SharePoint deserialization (CVE-2026-20963), BeyondTrust RS/PRA command injection (CVE-2026-1731), Fortinet FortiClient EMS SQL injection (CVE-2026-21643), Ivanti EPMM code injection (CVE-2026-1340), Cisco Secure Firewall Management Center deserialization (CVE-2026-20131), Broadcom VMware Aria Operations command injection (CVE-2026-22719), and Soliton FileZen command injection (CVE-2026-25108). The CVSS, KEV status, and vendor advisories were retained from the verified import; curation adds detection and response guidance.

package/data/_indexes/_meta.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-29T15:42:14.664Z",
+  "generated_at": "2026-05-29T17:12:20.887Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "e8e97bbe842dcab1f5fcde056ec1afc32a3c2ce6b9ddd7ee29a0fee8c606b9b1",
+    "manifest.json": "90e8775a672249381101e97d139798c3066b548ad2ad654e5f9b54fb04970032",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
-    "data/attack-techniques.json": "a55232127999ce6aed914016e7a8eab5104cb1142fe2196c9e6d4daf975a41c0",
-    "data/cve-catalog.json": "3dcdbf16b8c33352526399070142a65a077d1d8d39ce8283bda1d7fb5aa39852",
+    "data/attack-techniques.json": "9dfd1cfc0eafa912ac5dc7dbbe159df0ca2cbc7803e3f53fda22d8da3f4e93f5",
+    "data/cve-catalog.json": "b47297007f157d4100b9a5b84f9da82718eccd597e825232c7dad3aace2647d3",
     "data/cwe-catalog.json": "0fd275c2a61754958d68cea03a92794a67cf1c1d4d609f81a5728334df013ee3",
     "data/d3fend-catalog.json": "9a54bccb9f24f84b32024216cc3f53819a053721ac8ab43c326859e68fc0ffaf",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
@@ -15,7 +15,7 @@
     "data/framework-control-gaps.json": "29e7b6aa841ddf2530ca5971bdb60d7a715684b2f6264141ad49f0de9a039d78",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
     "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
-    "data/zeroday-lessons.json": "3ae4273d8d79b787bc5053da3de1aedab043ef97e1098e39be19975114f12ff9",
+    "data/zeroday-lessons.json": "0482d05de4bc26f87c92417cb99c82fd1fdcf820d766eaed5bc7eb734865ff4d",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "2880499993e0e69e3897a9d02b5e83aa0462c86a4dd2c1988b9968e375704a1f",
     "skills/mcp-agent-trust/skill.md": "0752834acde0303d6d1e36be4b320eac3d34fde715bb8d71f3ad9e801d701482",

package/data/attack-techniques.json

@@ -322,8 +322,10 @@
       "CVE-2025-68668",
       "CVE-2025-8747",
       "CVE-2026-0766",
+      "CVE-2026-1281",
       "CVE-2026-1340",
       "CVE-2026-1731",
+      "CVE-2026-20045",
       "CVE-2026-21858",
       "CVE-2026-21877",
       "CVE-2026-22252",
@@ -562,6 +564,7 @@
       "CVE-2026-20127",
       "CVE-2026-20182",
       "CVE-2026-21858",
+      "CVE-2026-23760",
       "CVE-2026-24061",
       "CVE-2026-24423",
       "CVE-2026-24858",
@@ -1067,9 +1070,11 @@
       "CVE-2026-0766",
       "CVE-2026-1281",
       "CVE-2026-1340",
+      "CVE-2026-1603",
       "CVE-2026-1731",
       "CVE-2026-20045",
       "CVE-2026-20122",
+      "CVE-2026-20127",
       "CVE-2026-20128",
       "CVE-2026-20131",
       "CVE-2026-20133",
@@ -1099,6 +1104,8 @@
       "CVE-2026-24213",
       "CVE-2026-24214",
       "CVE-2026-24215",
+      "CVE-2026-24423",
+      "CVE-2026-24858",
       "CVE-2026-25108",
       "CVE-2026-26015",
       "CVE-2026-26190",
@@ -1114,13 +1121,11 @@
       "CVE-2026-33634",
       "CVE-2026-34159",
       "CVE-2026-34197",
-      "CVE-2026-34621",
       "CVE-2026-3502",
       "CVE-2026-35616",
-      "CVE-2026-3909",
-      "CVE-2026-3910",
       "CVE-2026-39987",
       "CVE-2026-40933",
+      "CVE-2026-41940",
       "CVE-2026-41947",
       "CVE-2026-41950",
       "CVE-2026-42208",
@@ -1295,6 +1300,9 @@
       "CVE-2026-21385",
       "CVE-2026-2441",
       "CVE-2026-25592",
+      "CVE-2026-34621",
+      "CVE-2026-3909",
+      "CVE-2026-3910",
       "CVE-2026-5281",
       "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
     ],