@blamejs/exceptd-skills 0.18.18 → 0.18.20

package/ARCHITECTURE.md

@@ -176,7 +176,7 @@ Tracks PoC status, weaponization stage, and AI-assist factor per CVE. Updated wh
 
 ### `data/cwe-catalog.json`
 
-184 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
+189 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
 
 `_meta.cwe_version` pins the version; on a CWE release, audit IDs for renames or deprecations, bump `last_threat_review` on affected skills, and update `_meta`.
 

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.18.20 — 2026-06-28
+
+Twenty more CISA-KEV-listed, actively-exploited CVEs are now in the catalog (479 → 499), each curated to the full bar: verified NVD CVSS and CWE, MITRE ATT&CK mapping, behavioral indicators of compromise, global-first framework-control-gap analysis (NIST 800-53, ISO 27001:2022, EU NIS2, UK CAF, AU Essential Eight), an RWEP score, and a paired zero-day lesson. Five weakness classes the new entries reference were added to the CWE catalog (184 → 189): hard-coded cryptographic key (CWE-321), path equivalence (CWE-44) and incorrectly-resolved names (CWE-706), absolute path traversal (CWE-36), and improper isolation (CWE-653).
+
+The additions center on the March-2025 Windows kernel cluster — the Common Log File System use-after-free exploited as a ransomware privilege-escalation zero-day (CVE-2025-29824), the NTFS and Fast FAT crafted-VHD flaws (CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993), and the Win32k use-after-free (CVE-2025-24983) — plus the Chrome Mojo sandbox escape used in targeted espionage (CVE-2025-2783), the Apache Tomcat partial-PUT deserialization RCE (CVE-2025-24813), Fortinet FortiOS/FortiProxy authentication bypass (CVE-2025-24472), Juniper Junos improper isolation (CVE-2025-21590), Cisco Smart Licensing Utility static credentials (CVE-2024-20439), the SonicWall SMA100 command injection behind the OVERSTEP backdoor (CVE-2021-20035), the Linux kernel USB-audio flaws used in mobile-forensic extraction (CVE-2024-53150, CVE-2024-53197), and Gladinet CentreStack, Sitecore, SAP NetWeaver, NAKIVO, and Edimax flaws.
+
+## 0.18.19 — 2026-06-26
+
+Internal: the collector-enumeration gate and the collector tests now treat `__`-prefixed files under `lib/collectors/` as reserved scaffolding and skip them, since a real collector is always named `[a-z0-9-]+.js`. The gate's load-error/helper classification is also exercised against a throwaway directory rather than the shipped one, so a test run interrupted mid-fixture can no longer leave a stray module that fails subsequent local runs.
+
 ## 0.18.18 — 2026-06-26
 
 Twenty CISA-KEV-listed, actively-exploited CVEs are now in the catalog (459 → 479). Each is curated to the full bar: verified NVD CVSS and CWE, MITRE ATT&CK technique mapping, behavioral indicators of compromise, global-first framework-control-gap analysis (NIST 800-53, ISO 27001:2022, EU NIS2, UK CAF, AU Essential Eight), an RWEP score, and a paired zero-day lesson.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-27T01:18:25.795Z",
+  "generated_at": "2026-06-28T07:52:35.014Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "bc640c35c7a0edd249a986c657c816ce2aec5cbc52b237d59f64cbc7e3dfd8d6",
+    "manifest.json": "c7b75dd1cd77b282f6653b474f9f85b7dbf2fdc53fde76ea18ef35280505eeda",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
-    "data/attack-techniques.json": "35db05bc62be7a2db3d87bac4be67cbed3a9828779ff24e08cec8d43cc07feac",
-    "data/cve-catalog.json": "42d66a59039b964e6ed1b2c8d589de570901ff013e92d77a4e0804339b606ff6",
-    "data/cwe-catalog.json": "30a3b08ccf35d68554a480675151aa101ac7956ec018aa987926871754905be7",
+    "data/attack-techniques.json": "9766ea6eb2b7abd96f4a028d535d01aca176b084dc1d6d854c9bac42263d7a24",
+    "data/cve-catalog.json": "8f115499a1a554ad2fa19ed7c69afd758d6eeb8903e7b49f06b35068574eda4c",
+    "data/cwe-catalog.json": "0a63829b2e7baa5bb0d099f473d27b1dd08bdc1dfb1fe69f3a4f38bb8578607d",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "98715e3b7172b378064a0168349beb6104fd43ec55278e7611be69a3b4989271",
+    "data/framework-control-gaps.json": "39c5b141a3cea0b2264614ccb67eec5ea36feaa3c94b9090eb6e83a0c9ff671c",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "7ece7fa98582658713dc88b24fb9fc65d72148adfae7238b31e9356f1be9e711",
+    "data/zeroday-lessons.json": "1cafe8b3774c928fdcd0a1c0e00b55330e8846c115c582719034ec420d850a57",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "6eefa7772f1faf9c8ed971f2a827cd48398a12ab3b691b258c7c8364a5deb39c",
     "skills/mcp-agent-trust/skill.md": "bda6842bfa3b8bfd5edb3ef37751c493ff32a3ca80f771c3d988ede4176f0803",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 466,
-    "chains_cwe_entries": 184,
+    "chains_cve_entries": 486,
+    "chains_cwe_entries": 189,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -314,7 +314,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 479
+      "entry_count": 499
     },
     {
       "date": "2026-06-01",
@@ -322,7 +322,7 @@
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 184
+      "entry_count": 189
     },
     {
       "date": "2026-06-01",
@@ -330,7 +330,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 479
+      "entry_count": 499
     },
     {
       "date": "2026-05-27",

package/data/_indexes/catalog-summaries.json

@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 479,
+      "entry_count": 499,
       "sample_keys": [
         "CVE-2022-23812",
         "MAL-2026-TRAPDOOR-CROSS-ECOSYSTEM",
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 184,
+      "entry_count": 189,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 479,
+      "entry_count": 499,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",