@blamejs/exceptd-skills 0.18.20 → 0.18.21

package/data/cwe-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-06-01",
+    "last_updated": "2026-07-03",
     "cwe_version": "4.20",
     "cwe_version_release_date": "2026-04-30",
     "source": "https://cwe.mitre.org",
@@ -112,6 +112,7 @@
       "CVE-2024-31462",
       "CVE-2024-37032",
       "CVE-2024-39722",
+      "CVE-2024-4885",
       "CVE-2024-57728",
       "CVE-2024-7399",
       "CVE-2025-2749",
@@ -165,6 +166,7 @@
       "CVE-2016-10033",
       "CVE-2020-25079",
       "CVE-2021-33515",
+      "CVE-2023-20118",
       "CVE-2023-33538",
       "CVE-2024-12450",
       "CVE-2024-5565",
@@ -286,6 +288,7 @@
     ],
     "evidence_cves": [
       "CVE-2021-26829",
+      "CVE-2023-34192",
       "CVE-2023-6571",
       "CVE-2024-11182",
       "CVE-2024-27132",
@@ -362,6 +365,7 @@
     ],
     "evidence_cves": [
       "CVE-2024-43468",
+      "CVE-2025-25181",
       "CVE-2025-25257",
       "CVE-2025-57819",
       "CVE-2026-21643",
@@ -410,6 +414,7 @@
       "CVE-2013-3918",
       "CVE-2017-1000353",
       "CVE-2020-25078",
+      "CVE-2022-43769",
       "CVE-2022-48503",
       "CVE-2023-44467",
       "CVE-2023-6016",
@@ -666,6 +671,7 @@
       "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
       "CVE-2021-43226",
       "CVE-2024-21626",
+      "CVE-2024-49035",
       "CVE-2024-8068",
       "CVE-2025-48543",
       "CVE-2025-48572",
@@ -702,6 +708,7 @@
     ],
     "evidence_cves": [
       "CVE-2025-12480",
+      "CVE-2025-24989",
       "CVE-2025-31125",
       "CVE-2025-33073",
       "CVE-2025-59230",
@@ -1329,6 +1336,7 @@
     "evidence_cves": [
       "CVE-2018-4063",
       "CVE-2021-26828",
+      "CVE-2024-57968",
       "CVE-2024-7399",
       "CVE-2024-7694",
       "CVE-2025-2749",
@@ -1402,6 +1410,7 @@
       "webapp-security"
     ],
     "evidence_cves": [
+      "CVE-2017-3066",
       "CVE-2019-9874",
       "CVE-2019-9875",
       "CVE-2022-1471",
@@ -1409,6 +1418,7 @@
       "CVE-2024-11392",
       "CVE-2024-11393",
       "CVE-2024-11394",
+      "CVE-2024-20953",
       "CVE-2024-24590",
       "CVE-2024-37052",
       "CVE-2024-37060",
@@ -1441,7 +1451,8 @@
       "CVE-2026-3059",
       "CVE-2026-3060",
       "CVE-2026-31229",
-      "CVE-2026-45247"
+      "CVE-2026-45247",
+      "CVE-2026-45659"
     ],
     "framework_controls_partially_addressing": [
       "NIST-800-53-SI-10",
@@ -2634,7 +2645,8 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
-      "CVE-2025-59718"
+      "CVE-2025-59718",
+      "CVE-2026-48558"
     ],
     "last_verified": "2026-05-18",
     "notes": "Added v0.13.17 KEV bulk-import.",
@@ -2903,6 +2915,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2025-0111",
       "CVE-2025-24054",
       "CVE-2025-33053"
     ],
@@ -2924,6 +2937,7 @@
     "related_weaknesses": [],
     "evidence_cves": [
       "CVE-2021-38371",
+      "CVE-2022-43769",
       "CVE-2025-20281",
       "CVE-2025-20337"
     ],
@@ -3994,7 +4008,9 @@
       "CWE-2000"
     ],
     "related_weaknesses": [],
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2024-50302"
+    ],
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
@@ -4962,6 +4978,9 @@
     ],
     "skills_referencing": [],
     "evidence_cves": [
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2024-48248"
     ],
     "framework_controls_partially_addressing": [
@@ -4998,5 +5017,75 @@
     "real_requirement": "Enforce strong boundaries between trust domains (process/container/VM/privilege separation), deny cross-domain primitives by default, and audit the actual reachability between compartments rather than the documented design.",
     "lag_notes": "An architecture review attests that compartments exist; CWE-653 is about a real primitive that crosses them, which a design review on paper does not test.",
     "last_verified": "2026-06-28"
+  },
+  "CWE-707": {
+    "id": "CWE-707",
+    "name": "Improper Neutralization",
+    "abstraction": "Pillar",
+    "category": "Injection",
+    "description": "The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. Parent class of the injection weaknesses; CVE-2025-26633's MMC/MSC 'EvilTwin' console-file substitution bypasses the Microsoft Management Console security boundary by improperly neutralizing a crafted .msc file loaded from an en-US MUIPath directory.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-26633"
+    ]
+  },
+  "CWE-404": {
+    "id": "CWE-404",
+    "name": "Improper Resource Shutdown or Release",
+    "abstraction": "Class",
+    "category": "Resource Management",
+    "description": "The product does not release or incorrectly releases a resource before it is made available for re-use, enabling use-after-free and related memory-safety failures. CVE-2018-8639 is a Win32k kernel use-after-free (improper resource release) that a local low-privileged user leverages for arbitrary kernel-mode code execution and SYSTEM elevation.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000",
+      "CWE-1003"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2018-8639"
+    ]
+  },
+  "CWE-647": {
+    "id": "CWE-647",
+    "name": "Use of Non-Canonical URL Paths for Authorization Decisions",
+    "abstraction": "Base",
+    "category": "Authorization",
+    "description": "The product makes authorization decisions based on the assumption that a requested URL is canonical, so a crafted non-canonical URL can bypass the authorization check. CVE-2022-43939's Pentaho BA Server authorization bypass accepts non-canonical URLs (a permissive suffix match) to reach protected endpoints unauthenticated, and is chained with the special-element-injection CVE-2022-43769 for pre-auth RCE.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000",
+      "CWE-1003"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2022-43939"
+    ]
+  },
+  "CWE-610": {
+    "id": "CWE-610",
+    "name": "Externally Controlled Reference to a Resource in Another Sphere",
+    "abstraction": "Class",
+    "category": "Resource Control",
+    "description": "The product uses an externally controlled name or reference that resolves to a resource outside the intended control sphere — the parent class of server-side request forgery and external control of a filename or path. CVE-2025-0111's PAN-OS authenticated arbitrary file read lets a management-interface request reference filesystem paths readable by the 'nobody' user that sit outside the intended web-interface sphere, and is chained with the CVE-2025-0108 auth bypass to read config and credential material unauthenticated.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [],
+    "skills_referencing": [],
+    "evidence_cves": [
+      "CVE-2025-0111"
+    ]
   }
 }

package/data/framework-control-gaps.json

@@ -342,16 +342,31 @@
     "opened_date": "2026-05-13",
     "evidence_cves": [
       "CVE-2017-12637",
+      "CVE-2017-3066",
+      "CVE-2018-8639",
       "CVE-2019-9874",
       "CVE-2019-9875",
       "CVE-2021-20035",
+      "CVE-2022-43769",
+      "CVE-2022-43939",
+      "CVE-2023-20118",
+      "CVE-2023-34192",
       "CVE-2023-44221",
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2024-20439",
+      "CVE-2024-20953",
       "CVE-2024-38475",
       "CVE-2024-48248",
+      "CVE-2024-4885",
+      "CVE-2024-49035",
+      "CVE-2024-50302",
       "CVE-2024-53150",
       "CVE-2024-53197",
+      "CVE-2024-57968",
       "CVE-2024-58136",
+      "CVE-2025-0111",
       "CVE-2025-1316",
       "CVE-2025-1976",
       "CVE-2025-21590",
@@ -361,8 +376,11 @@
       "CVE-2025-24983",
       "CVE-2025-24984",
       "CVE-2025-24985",
+      "CVE-2025-24989",
       "CVE-2025-24991",
       "CVE-2025-24993",
+      "CVE-2025-25181",
+      "CVE-2025-26633",
       "CVE-2025-2783",
       "CVE-2025-29824",
       "CVE-2025-30406",
@@ -379,6 +397,8 @@
       "CVE-2026-34908",
       "CVE-2026-34909",
       "CVE-2026-34910",
+      "CVE-2026-45659",
+      "CVE-2026-48558",
       "CVE-2026-48907",
       "CVE-2026-54420"
     ],
@@ -512,7 +532,7 @@
       "Treating 'Top 25 addressed' as a compliance signal creates a compliance-theatre risk for organisations with significant AI surface",
       "No cross-walk requirement to ATLAS TTPs — CWE addresses weaknesses; ATLAS addresses adversary techniques. Both are needed for AI coverage"
     ],
-    "real_requirement": "Programmes that claim 'Top 25 addressed' as compliance evidence must additionally: (1) enumerate AI-relevant CWEs outside the Top 25 (CWE-1426 Improper Output Validation, CWE-1039 Inadequate Detection of Adversarial Input, CWE-1230 Exposure of Sensitive Info Through Metadata) with explicit treatment, (2) cross-walk to ATLAS v2026.05 TTPs for adversarial coverage, (3) re-baseline against the next-published Top 25 with delta analysis. Aligns with EU CRA Annex I, UK NCSC, AU ISM, ISO 27001 A.8.28.",
+    "real_requirement": "Programmes that claim 'Top 25 addressed' as compliance evidence must additionally: (1) enumerate AI-relevant CWEs outside the Top 25 (CWE-1426 Improper Output Validation, CWE-1039 Inadequate Detection of Adversarial Input, CWE-1230 Exposure of Sensitive Info Through Metadata) with explicit treatment, (2) cross-walk to ATLAS v2026.06 TTPs for adversarial coverage, (3) re-baseline against the next-published Top 25 with delta analysis. Aligns with EU CRA Annex I, UK NCSC, AU ISM, ISO 27001 A.8.28.",
     "status": "open",
     "opened_date": "2026-05-11",
     "evidence_cves": [],
@@ -1485,9 +1505,11 @@
       "CVE-2016-7836",
       "CVE-2017-1000353",
       "CVE-2017-12637",
+      "CVE-2017-3066",
       "CVE-2017-7921",
       "CVE-2018-14634",
       "CVE-2018-4063",
+      "CVE-2018-8639",
       "CVE-2019-19006",
       "CVE-2019-5418",
       "CVE-2019-6693",
@@ -1519,12 +1541,16 @@
       "CVE-2022-20775",
       "CVE-2022-37055",
       "CVE-2022-40799",
+      "CVE-2022-43769",
+      "CVE-2022-43939",
       "CVE-2022-48503",
       "CVE-2023-0386",
+      "CVE-2023-20118",
       "CVE-2023-21529",
       "CVE-2023-2533",
       "CVE-2023-27351",
       "CVE-2023-33538",
+      "CVE-2023-34192",
       "CVE-2023-36424",
       "CVE-2023-38950",
       "CVE-2023-39780",
@@ -1553,9 +1579,13 @@
       "CVE-2024-11394",
       "CVE-2024-12987",
       "CVE-2024-13059",
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2024-1561",
       "CVE-2024-1708",
       "CVE-2024-20439",
+      "CVE-2024-20953",
       "CVE-2024-21513",
       "CVE-2024-21575",
       "CVE-2024-21576",
@@ -1572,14 +1602,18 @@
       "CVE-2024-42479",
       "CVE-2024-43468",
       "CVE-2024-48248",
+      "CVE-2024-4885",
       "CVE-2024-4889",
+      "CVE-2024-49035",
       "CVE-2024-50050",
+      "CVE-2024-50302",
       "CVE-2024-53150",
       "CVE-2024-53197",
       "CVE-2024-54085",
       "CVE-2024-56145",
       "CVE-2024-57726",
       "CVE-2024-57728",
+      "CVE-2024-57968",
       "CVE-2024-58136",
       "CVE-2024-6047",
       "CVE-2024-6587",
@@ -1587,6 +1621,7 @@
       "CVE-2024-7694",
       "CVE-2024-8068",
       "CVE-2024-8069",
+      "CVE-2025-0111",
       "CVE-2025-0282",
       "CVE-2025-10035",
       "CVE-2025-10585",
@@ -1624,11 +1659,14 @@
       "CVE-2025-24983",
       "CVE-2025-24984",
       "CVE-2025-24985",
+      "CVE-2025-24989",
       "CVE-2025-24990",
       "CVE-2025-24991",
       "CVE-2025-24993",
+      "CVE-2025-25181",
       "CVE-2025-25257",
       "CVE-2025-26399",
+      "CVE-2025-26633",
       "CVE-2025-27038",
       "CVE-2025-27363",
       "CVE-2025-2746",
@@ -1838,11 +1876,13 @@
       "CVE-2026-42945",
       "CVE-2026-45247",
       "CVE-2026-45498",
+      "CVE-2026-45659",
       "CVE-2026-45829",
       "CVE-2026-46300",
       "CVE-2026-46333",
       "CVE-2026-48027",
       "CVE-2026-48172",
+      "CVE-2026-48558",
       "CVE-2026-48907",
       "CVE-2026-50751",
       "CVE-2026-5281",
@@ -1911,7 +1951,7 @@
       "LLM-API-as-C2 (SesameOp pattern, ATLAS AML.T0096) is not in the clause 6.1.2 example threat list — risk register templates omit it",
       "No requirement to link AI risk register entries to specific TTP IDs (ATLAS / ATT&CK) — risks remain framework-internal abstractions"
     ],
-    "real_requirement": "Clause 6.1.2 risk registers must (1) ingest ATLAS v2026.05 TTPs as enumerated AI-specific threat sources, (2) cross-reference jurisdictional obligations (EU AI Act Annex III, NIS2 Art. 21, DORA Art. 28, UK CAF B4, AU ISM AI annex, ISO 27001:2022 A.5.7), (3) include AI-API-as-C2 and prompt-injection-as-RCE as named scenarios, (4) be re-run on threat-intel triggers, not only on calendar cycles.",
+    "real_requirement": "Clause 6.1.2 risk registers must (1) ingest ATLAS v2026.06 TTPs as enumerated AI-specific threat sources, (2) cross-reference jurisdictional obligations (EU AI Act Annex III, NIS2 Art. 21, DORA Art. 28, UK CAF B4, AU ISM AI annex, ISO 27001:2022 A.5.7), (3) include AI-API-as-C2 and prompt-injection-as-RCE as named scenarios, (4) be re-run on threat-intel triggers, not only on calendar cycles.",
     "status": "open",
     "opened_date": "2026-05-11",
     "evidence_cves": [],
@@ -2725,9 +2765,11 @@
       "CVE-2016-7836",
       "CVE-2017-1000353",
       "CVE-2017-12637",
+      "CVE-2017-3066",
       "CVE-2017-7921",
       "CVE-2018-14634",
       "CVE-2018-4063",
+      "CVE-2018-8639",
       "CVE-2019-19006",
       "CVE-2019-5418",
       "CVE-2019-6693",
@@ -2760,12 +2802,16 @@
       "CVE-2022-20775",
       "CVE-2022-37055",
       "CVE-2022-40799",
+      "CVE-2022-43769",
+      "CVE-2022-43939",
       "CVE-2022-48503",
       "CVE-2023-0386",
+      "CVE-2023-20118",
       "CVE-2023-21529",
       "CVE-2023-2533",
       "CVE-2023-27351",
       "CVE-2023-33538",
+      "CVE-2023-34192",
       "CVE-2023-3519",
       "CVE-2023-36424",
       "CVE-2023-38950",
@@ -2796,9 +2842,13 @@
       "CVE-2024-11394",
       "CVE-2024-12987",
       "CVE-2024-13059",
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2024-1561",
       "CVE-2024-1708",
       "CVE-2024-20439",
+      "CVE-2024-20953",
       "CVE-2024-21182",
       "CVE-2024-21513",
       "CVE-2024-21575",
@@ -2818,14 +2868,18 @@
       "CVE-2024-42479",
       "CVE-2024-43468",
       "CVE-2024-48248",
+      "CVE-2024-4885",
       "CVE-2024-4889",
+      "CVE-2024-49035",
       "CVE-2024-50050",
+      "CVE-2024-50302",
       "CVE-2024-53150",
       "CVE-2024-53197",
       "CVE-2024-54085",
       "CVE-2024-56145",
       "CVE-2024-57726",
       "CVE-2024-57728",
+      "CVE-2024-57968",
       "CVE-2024-58136",
       "CVE-2024-6047",
       "CVE-2024-6587",
@@ -2833,6 +2887,7 @@
       "CVE-2024-7694",
       "CVE-2024-8068",
       "CVE-2024-8069",
+      "CVE-2025-0111",
       "CVE-2025-0282",
       "CVE-2025-10035",
       "CVE-2025-10164",
@@ -2873,11 +2928,14 @@
       "CVE-2025-24983",
       "CVE-2025-24984",
       "CVE-2025-24985",
+      "CVE-2025-24989",
       "CVE-2025-24990",
       "CVE-2025-24991",
       "CVE-2025-24993",
+      "CVE-2025-25181",
       "CVE-2025-25257",
       "CVE-2025-26399",
+      "CVE-2025-26633",
       "CVE-2025-27038",
       "CVE-2025-27363",
       "CVE-2025-2746",
@@ -3100,9 +3158,11 @@
       "CVE-2026-43500",
       "CVE-2026-45247",
       "CVE-2026-45498",
+      "CVE-2026-45659",
       "CVE-2026-45829",
       "CVE-2026-46300",
       "CVE-2026-46333",
+      "CVE-2026-48558",
       "CVE-2026-48907",
       "CVE-2026-50751",
       "CVE-2026-5281",
@@ -5373,27 +5433,45 @@
     "opened_date": "2026-05-15",
     "evidence_cves": [
       "CVE-2017-12637",
+      "CVE-2017-3066",
+      "CVE-2018-8639",
       "CVE-2019-9874",
       "CVE-2019-9875",
+      "CVE-2022-43769",
+      "CVE-2022-43939",
+      "CVE-2023-20118",
+      "CVE-2023-34192",
       "CVE-2023-3519",
       "CVE-2023-6571",
       "CVE-2024-12366",
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2024-20439",
+      "CVE-2024-20953",
       "CVE-2024-2912",
       "CVE-2024-38475",
       "CVE-2024-48248",
+      "CVE-2024-4885",
+      "CVE-2024-49035",
+      "CVE-2024-50302",
       "CVE-2024-53150",
       "CVE-2024-53197",
       "CVE-2024-5565",
+      "CVE-2024-57968",
       "CVE-2024-58136",
       "CVE-2024-9526",
+      "CVE-2025-0111",
       "CVE-2025-24054",
       "CVE-2025-24813",
       "CVE-2025-24983",
       "CVE-2025-24984",
       "CVE-2025-24985",
+      "CVE-2025-24989",
       "CVE-2025-24991",
       "CVE-2025-24993",
+      "CVE-2025-25181",
+      "CVE-2025-26633",
       "CVE-2025-27520",
       "CVE-2025-2783",
       "CVE-2025-29824",
@@ -5409,6 +5487,8 @@
       "CVE-2026-12569",
       "CVE-2026-20253",
       "CVE-2026-42945",
+      "CVE-2026-45659",
+      "CVE-2026-48558",
       "CVE-2026-48907",
       "CVE-2026-54420"
     ],
@@ -6120,6 +6200,8 @@
     "evidence_cves": [
       "CVE-2011-0411",
       "CVE-2017-12637",
+      "CVE-2017-3066",
+      "CVE-2018-8639",
       "CVE-2019-9874",
       "CVE-2019-9875",
       "CVE-2021-20035",
@@ -6128,6 +6210,10 @@
       "CVE-2022-0492",
       "CVE-2022-23812",
       "CVE-2022-36551",
+      "CVE-2022-43769",
+      "CVE-2022-43939",
+      "CVE-2023-20118",
+      "CVE-2023-34192",
       "CVE-2023-43791",
       "CVE-2023-44221",
       "CVE-2023-44467",
@@ -6145,8 +6231,12 @@
       "CVE-2024-12366",
       "CVE-2024-12450",
       "CVE-2024-13059",
+      "CVE-2024-13159",
+      "CVE-2024-13160",
+      "CVE-2024-13161",
       "CVE-2024-1561",
       "CVE-2024-20439",
+      "CVE-2024-20953",
       "CVE-2024-21182",
       "CVE-2024-21513",
       "CVE-2024-21575",
@@ -6165,13 +6255,18 @@
       "CVE-2024-42478",
       "CVE-2024-42479",
       "CVE-2024-48248",
+      "CVE-2024-4885",
+      "CVE-2024-49035",
       "CVE-2024-50050",
+      "CVE-2024-50302",
       "CVE-2024-53150",
       "CVE-2024-53197",
       "CVE-2024-5565",
+      "CVE-2024-57968",
       "CVE-2024-58136",
       "CVE-2024-6047",
       "CVE-2024-9526",
+      "CVE-2025-0111",
       "CVE-2025-0282",
       "CVE-2025-10164",
       "CVE-2025-1316",
@@ -6188,9 +6283,12 @@
       "CVE-2025-24983",
       "CVE-2025-24984",
       "CVE-2025-24985",
+      "CVE-2025-24989",
       "CVE-2025-24991",
       "CVE-2025-24993",
+      "CVE-2025-25181",
       "CVE-2025-25297",
+      "CVE-2025-26633",
       "CVE-2025-27363",
       "CVE-2025-27520",
       "CVE-2025-2783",
@@ -6263,10 +6361,12 @@
       "CVE-2026-42271",
       "CVE-2026-45247",
       "CVE-2026-45498",
+      "CVE-2026-45659",
       "CVE-2026-45829",
       "CVE-2026-46300",
       "CVE-2026-46333",
       "CVE-2026-48172",
+      "CVE-2026-48558",
       "CVE-2026-48907",
       "CVE-2026-54420",
       "CVE-2026-5760",
@@ -7532,7 +7632,7 @@
     }
   },
   "ATLAS-AML.T0048": {
-    "framework": "MITRE ATLAS v2026.05",
+    "framework": "MITRE ATLAS v2026.06",
     "control_id": "AML.T0048",
     "control_name": "External Harms — ML Supply Chain Compromise (bundled-codec / inference-server class)",
     "designed_for": "ATLAS AML.T0048 catalogues external harms from ML supply-chain compromise, including malicious model weights, poisoned training data, and compromised ML libraries. The technique-level guidance covers detection and mitigation at the model-artifact and library-consumption layer.",