@blamejs/exceptd-skills 0.18.17 → 0.18.19

package/ARCHITECTURE.md

@@ -176,7 +176,7 @@ Tracks PoC status, weaponization stage, and AI-assist factor per CVE. Updated wh
 
 ### `data/cwe-catalog.json`
 
-181 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
+184 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
 
 `_meta.cwe_version` pins the version; on a CWE release, audit IDs for renames or deprecations, bump `last_threat_review` on affected skills, and update `_meta`.
 

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.18.19 — 2026-06-26
+
+Internal: the collector-enumeration gate and the collector tests now treat `__`-prefixed files under `lib/collectors/` as reserved scaffolding and skip them, since a real collector is always named `[a-z0-9-]+.js`. The gate's load-error/helper classification is also exercised against a throwaway directory rather than the shipped one, so a test run interrupted mid-fixture can no longer leave a stray module that fails subsequent local runs.
+
+## 0.18.18 — 2026-06-26
+
+Twenty CISA-KEV-listed, actively-exploited CVEs are now in the catalog (459 → 479). Each is curated to the full bar: verified NVD CVSS and CWE, MITRE ATT&CK technique mapping, behavioral indicators of compromise, global-first framework-control-gap analysis (NIST 800-53, ISO 27001:2022, EU NIS2, UK CAF, AU Essential Eight), an RWEP score, and a paired zero-day lesson.
+
+The additions cover current edge- and enterprise-exploitation activity: the Apple CoreAudio and pointer-authentication-bypass zero-days from the mid-2025 targeted-spyware chain (CVE-2025-31200, CVE-2025-31201); the Windows NTLM hash-disclosure flaw (CVE-2025-24054); the Commvault Command Center and Web Server RCEs (CVE-2025-34028, CVE-2025-3928); the SonicWall SMA100 command injection (CVE-2023-44221); the Apache HTTP Server mod_rewrite output-escaping flaw (CVE-2024-38475); the Yii framework alternate-path RCE (CVE-2024-58136); the Cisco Unified CM SSRF-to-root and Catalyst SD-WAN Manager traversal (CVE-2026-20230, CVE-2026-20262); the Splunk Enterprise missing-authentication RCE (CVE-2026-20253); the Ubiquiti UniFi OS access-control, path-traversal, and command-injection chain behind the azsxd botnet (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910); and the Lantronix EDS5000 OT device-server, Broadcom Brocade Fabric OS, Qualitia Active! Mail, Joomla Content Editor, LiteSpeed cPanel plugin, and PTC Windchill/FlexPLM flaws.
+
 ## 0.18.17 — 2026-06-24
 
 A correctness pass across the upstream-refresh pipeline, the credential and MCP collectors, scoring and framework analysis, attestation hashing, and the release gates.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-25T03:42:18.191Z",
+  "generated_at": "2026-06-27T05:26:07.177Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "20836959eb7562901f9fb4445fa930f3e6b9890439eb97edefa00de23ff40d93",
+    "manifest.json": "13d587cacfda30ec0b15d8e0901397e21daacdd31af95e86210f372e41c1d44d",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
-    "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",
-    "data/cve-catalog.json": "06ca53e69071dfe94867c10717f3ff2962c50341defcaf050f1a96236b5be51c",
-    "data/cwe-catalog.json": "359263361fa52069e2856cc352d8f1c757d614ea840db6ef3ff5e696185ca220",
+    "data/attack-techniques.json": "35db05bc62be7a2db3d87bac4be67cbed3a9828779ff24e08cec8d43cc07feac",
+    "data/cve-catalog.json": "42d66a59039b964e6ed1b2c8d589de570901ff013e92d77a4e0804339b606ff6",
+    "data/cwe-catalog.json": "30a3b08ccf35d68554a480675151aa101ac7956ec018aa987926871754905be7",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "760c2275803c6da3665ce538c5176bde6f041b68cc3d4808b8de961dfcdee6b8",
+    "data/framework-control-gaps.json": "98715e3b7172b378064a0168349beb6104fd43ec55278e7611be69a3b4989271",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "8c69eec9103eeea236ceb1a157d62b35bafcf8a5de86502e25e4587cc5931247",
+    "data/zeroday-lessons.json": "7ece7fa98582658713dc88b24fb9fc65d72148adfae7238b31e9356f1be9e711",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "6eefa7772f1faf9c8ed971f2a827cd48398a12ab3b691b258c7c8364a5deb39c",
     "skills/mcp-agent-trust/skill.md": "bda6842bfa3b8bfd5edb3ef37751c493ff32a3ca80f771c3d988ede4176f0803",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 446,
-    "chains_cwe_entries": 181,
+    "chains_cve_entries": 466,
+    "chains_cwe_entries": 184,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -314,7 +314,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 459
+      "entry_count": 479
     },
     {
       "date": "2026-06-01",
@@ -322,7 +322,7 @@
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 181
+      "entry_count": 184
     },
     {
       "date": "2026-06-01",
@@ -330,7 +330,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 459
+      "entry_count": 479
     },
     {
       "date": "2026-05-27",

package/data/_indexes/catalog-summaries.json

@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 459,
+      "entry_count": 479,
       "sample_keys": [
         "CVE-2022-23812",
         "MAL-2026-TRAPDOOR-CROSS-ECOSYSTEM",
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 181,
+      "entry_count": 184,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 459,
+      "entry_count": 479,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",