@blamejs/exceptd-skills 0.18.20 → 0.18.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. package/AGENTS.md +3 -3
  2. package/ARCHITECTURE.md +4 -4
  3. package/CHANGELOG.md +12 -0
  4. package/CONTEXT.md +2 -2
  5. package/README.md +5 -5
  6. package/agents/threat-researcher.md +2 -2
  7. package/bin/exceptd.js +4 -1
  8. package/data/_indexes/_meta.json +43 -43
  9. package/data/_indexes/activity-feed.json +26 -26
  10. package/data/_indexes/catalog-summaries.json +12 -12
  11. package/data/_indexes/chains.json +67238 -589
  12. package/data/_indexes/frequency.json +10 -0
  13. package/data/_indexes/recipes.json +1 -1
  14. package/data/_indexes/section-offsets.json +82 -82
  15. package/data/_indexes/summary-cards.json +1 -1
  16. package/data/_indexes/token-budget.json +19 -19
  17. package/data/atlas-ttps.json +7 -7
  18. package/data/attack-techniques.json +295 -8
  19. package/data/cve-catalog.json +11443 -2
  20. package/data/cwe-catalog.json +366 -11
  21. package/data/framework-control-gaps.json +622 -15
  22. package/data/zeroday-lessons.json +5017 -2
  23. package/lib/auto-discovery.js +54 -67
  24. package/lib/cve-batch.js +216 -0
  25. package/lib/cve-curation.js +4 -0
  26. package/lib/cve-enrich.js +172 -0
  27. package/lib/prefetch.js +189 -110
  28. package/lib/schemas/skill-frontmatter.schema.json +1 -1
  29. package/lib/scoring.js +24 -0
  30. package/lib/version-pins.js +1 -1
  31. package/manifest-snapshot.json +2 -2
  32. package/manifest-snapshot.sha256 +1 -1
  33. package/manifest.json +88 -88
  34. package/package.json +2 -2
  35. package/sbom.cdx.json +149 -119
  36. package/scripts/builders/catalog-summaries.js +1 -1
  37. package/scripts/builders/recipes.js +1 -1
  38. package/skills/age-gates-child-safety/skill.md +2 -2
  39. package/skills/ai-attack-surface/skill.md +3 -3
  40. package/skills/ai-c2-detection/skill.md +4 -4
  41. package/skills/api-security/skill.md +1 -1
  42. package/skills/attack-surface-pentest/skill.md +3 -3
  43. package/skills/cloud-security/skill.md +2 -2
  44. package/skills/compliance-theater/skill.md +2 -2
  45. package/skills/container-runtime-security/skill.md +2 -2
  46. package/skills/coordinated-vuln-disclosure/skill.md +1 -1
  47. package/skills/dlp-gap-analysis/skill.md +4 -4
  48. package/skills/exploit-scoring/skill.md +1 -1
  49. package/skills/framework-gap-analysis/skill.md +3 -3
  50. package/skills/fuzz-testing-strategy/skill.md +1 -1
  51. package/skills/incident-response-playbook/skill.md +1 -1
  52. package/skills/mcp-agent-trust/skill.md +1 -1
  53. package/skills/mlops-security/skill.md +2 -2
  54. package/skills/ot-ics-security/skill.md +2 -2
  55. package/skills/policy-exception-gen/skill.md +2 -2
  56. package/skills/rag-pipeline-security/skill.md +3 -3
  57. package/skills/ransomware-response/skill.md +1 -1
  58. package/skills/sector-energy/skill.md +1 -1
  59. package/skills/sector-federal-government/skill.md +1 -1
  60. package/skills/sector-financial/skill.md +3 -3
  61. package/skills/sector-healthcare/skill.md +2 -2
  62. package/skills/security-maturity-tiers/skill.md +1 -1
  63. package/skills/skill-update-loop/skill.md +4 -4
  64. package/skills/supply-chain-integrity/skill.md +1 -1
  65. package/skills/threat-model-currency/skill.md +7 -7
  66. package/skills/threat-modeling-methodology/skill.md +1 -1
  67. package/skills/webapp-security/skill.md +1 -1
  68. package/skills/zeroday-gap-learn/skill.md +2 -2
package/data/framework-control-gaps.json CHANGED
@@ -239,7 +239,23 @@
239
239
  "real_requirement": "User-application hardening enumerates AI assistants and MCP servers in scope; sets default-deny on tool grants with explicit per-tool acknowledgement; pins MCP server versions with signature verification; treats AI-tool config files (.claude/settings.json, .cursor/mcp.json, .vscode/settings.json's chat.tools.autoApprove) as integrity-monitored configuration with the same protection profile as security-sensitive files.",
240
240
  "status": "open",
241
241
  "opened_date": "2026-05-13",
242
- "evidence_cves": [],
242
+ "evidence_cves": [
243
+ "CVE-2018-9276",
244
+ "CVE-2019-16278",
245
+ "CVE-2022-23748",
246
+ "CVE-2024-29059",
247
+ "CVE-2024-41710",
248
+ "CVE-2024-43572",
249
+ "CVE-2024-43573",
250
+ "CVE-2024-44308",
251
+ "CVE-2024-49039",
252
+ "CVE-2024-55956",
253
+ "CVE-2024-8957",
254
+ "CVE-2024-9463",
255
+ "CVE-2024-9680",
256
+ "CVE-2025-0411",
257
+ "CVE-2026-48939"
258
+ ],
243
259
  "atlas_refs": [
244
260
  "AML.T0010",
245
261
  "AML.T0051"
@@ -341,28 +357,108 @@
341
357
  "status": "open",
342
358
  "opened_date": "2026-05-13",
343
359
  "evidence_cves": [
360
+ "CVE-2014-2120",
344
361
  "CVE-2017-12637",
362
+ "CVE-2017-3066",
363
+ "CVE-2018-14933",
364
+ "CVE-2018-19410",
365
+ "CVE-2018-8639",
366
+ "CVE-2019-11001",
345
367
  "CVE-2019-9874",
346
368
  "CVE-2019-9875",
369
+ "CVE-2020-11023",
370
+ "CVE-2020-15069",
371
+ "CVE-2020-15415",
372
+ "CVE-2020-2883",
347
373
  "CVE-2021-20035",
374
+ "CVE-2021-26086",
375
+ "CVE-2021-40407",
376
+ "CVE-2021-41277",
377
+ "CVE-2022-23227",
378
+ "CVE-2022-43769",
379
+ "CVE-2022-43939",
380
+ "CVE-2023-20118",
381
+ "CVE-2023-25280",
382
+ "CVE-2023-28461",
383
+ "CVE-2023-34192",
348
384
  "CVE-2023-44221",
385
+ "CVE-2023-45727",
386
+ "CVE-2023-48365",
387
+ "CVE-2024-11667",
388
+ "CVE-2024-11680",
389
+ "CVE-2024-1212",
390
+ "CVE-2024-12356",
391
+ "CVE-2024-12686",
392
+ "CVE-2024-13159",
393
+ "CVE-2024-13160",
394
+ "CVE-2024-13161",
349
395
  "CVE-2024-20439",
396
+ "CVE-2024-20767",
397
+ "CVE-2024-20953",
398
+ "CVE-2024-21413",
399
+ "CVE-2024-23113",
400
+ "CVE-2024-29824",
401
+ "CVE-2024-30088",
402
+ "CVE-2024-3393",
403
+ "CVE-2024-35250",
350
404
  "CVE-2024-38475",
405
+ "CVE-2024-38812",
406
+ "CVE-2024-38813",
407
+ "CVE-2024-40711",
408
+ "CVE-2024-40890",
409
+ "CVE-2024-40891",
410
+ "CVE-2024-43047",
411
+ "CVE-2024-44309",
412
+ "CVE-2024-45195",
413
+ "CVE-2024-45519",
414
+ "CVE-2024-47575",
351
415
  "CVE-2024-48248",
416
+ "CVE-2024-4885",
417
+ "CVE-2024-49035",
418
+ "CVE-2024-49138",
419
+ "CVE-2024-50302",
420
+ "CVE-2024-50603",
421
+ "CVE-2024-51378",
422
+ "CVE-2024-51567",
423
+ "CVE-2024-53104",
352
424
  "CVE-2024-53150",
353
425
  "CVE-2024-53197",
426
+ "CVE-2024-53704",
427
+ "CVE-2024-55550",
428
+ "CVE-2024-55591",
429
+ "CVE-2024-57727",
430
+ "CVE-2024-57968",
354
431
  "CVE-2024-58136",
432
+ "CVE-2024-5910",
433
+ "CVE-2024-7593",
434
+ "CVE-2024-8956",
435
+ "CVE-2024-9379",
436
+ "CVE-2024-9380",
437
+ "CVE-2024-9474",
438
+ "CVE-2025-0108",
439
+ "CVE-2025-0111",
440
+ "CVE-2025-0994",
355
441
  "CVE-2025-1316",
356
442
  "CVE-2025-1976",
443
+ "CVE-2025-21333",
444
+ "CVE-2025-21334",
445
+ "CVE-2025-21335",
446
+ "CVE-2025-21418",
357
447
  "CVE-2025-21590",
448
+ "CVE-2025-23006",
449
+ "CVE-2025-23209",
358
450
  "CVE-2025-24054",
451
+ "CVE-2025-24085",
359
452
  "CVE-2025-24472",
360
453
  "CVE-2025-24813",
361
454
  "CVE-2025-24983",
362
455
  "CVE-2025-24984",
363
456
  "CVE-2025-24985",
457
+ "CVE-2025-24989",
364
458
  "CVE-2025-24991",
365
459
  "CVE-2025-24993",
460
+ "CVE-2025-25181",
461
+ "CVE-2025-26633",
366
462
  "CVE-2025-2783",
367
463
  "CVE-2025-29824",
368
464
  "CVE-2025-30406",
@@ -379,8 +475,12 @@
379
475
  "CVE-2026-34908",
380
476
  "CVE-2026-34909",
381
477
  "CVE-2026-34910",
478
+ "CVE-2026-45659",
479
+ "CVE-2026-48558",
382
480
  "CVE-2026-48907",
383
- "CVE-2026-54420"
481
+ "CVE-2026-54420",
482
+ "CVE-2026-56290",
483
+ "CVE-2026-56291"
384
484
  ],
385
485
  "atlas_refs": [],
386
486
  "attack_refs": [
@@ -512,7 +612,7 @@
512
612
  "Treating 'Top 25 addressed' as a compliance signal creates a compliance-theatre risk for organisations with significant AI surface",
513
613
  "No cross-walk requirement to ATLAS TTPs — CWE addresses weaknesses; ATLAS addresses adversary techniques. Both are needed for AI coverage"
514
614
  ],
515
- "real_requirement": "Programmes that claim 'Top 25 addressed' as compliance evidence must additionally: (1) enumerate AI-relevant CWEs outside the Top 25 (CWE-1426 Improper Output Validation, CWE-1039 Inadequate Detection of Adversarial Input, CWE-1230 Exposure of Sensitive Info Through Metadata) with explicit treatment, (2) cross-walk to ATLAS v2026.05 TTPs for adversarial coverage, (3) re-baseline against the next-published Top 25 with delta analysis. Aligns with EU CRA Annex I, UK NCSC, AU ISM, ISO 27001 A.8.28.",
615
+ "real_requirement": "Programmes that claim 'Top 25 addressed' as compliance evidence must additionally: (1) enumerate AI-relevant CWEs outside the Top 25 (CWE-1426 Improper Output Validation, CWE-1039 Inadequate Detection of Adversarial Input, CWE-1230 Exposure of Sensitive Info Through Metadata) with explicit treatment, (2) cross-walk to ATLAS v2026.06 TTPs for adversarial coverage, (3) re-baseline against the next-published Top 25 with delta analysis. Aligns with EU CRA Annex I, UK NCSC, AU ISM, ISO 27001 A.8.28.",
516
616
  "status": "open",
517
617
  "opened_date": "2026-05-11",
518
618
  "evidence_cves": [],
@@ -1478,6 +1578,7 @@
1478
1578
  "CVE-2012-1854",
1479
1579
  "CVE-2013-3893",
1480
1580
  "CVE-2013-3918",
1581
+ "CVE-2014-2120",
1481
1582
  "CVE-2014-3931",
1482
1583
  "CVE-2014-6278",
1483
1584
  "CVE-2015-7755",
@@ -1485,15 +1586,22 @@
1485
1586
  "CVE-2016-7836",
1486
1587
  "CVE-2017-1000353",
1487
1588
  "CVE-2017-12637",
1589
+ "CVE-2017-3066",
1488
1590
  "CVE-2017-7921",
1489
1591
  "CVE-2018-14634",
1592
+ "CVE-2018-14933",
1490
1593
  "CVE-2018-4063",
1594
+ "CVE-2018-8639",
1595
+ "CVE-2019-0344",
1596
+ "CVE-2019-16278",
1491
1597
  "CVE-2019-19006",
1492
1598
  "CVE-2019-5418",
1493
1599
  "CVE-2019-6693",
1494
1600
  "CVE-2019-9621",
1495
1601
  "CVE-2019-9874",
1496
1602
  "CVE-2019-9875",
1603
+ "CVE-2020-11023",
1604
+ "CVE-2020-15069",
1497
1605
  "CVE-2020-17103-REREGRESSION-2026",
1498
1606
  "CVE-2020-24363",
1499
1607
  "CVE-2020-25078",
@@ -1506,6 +1614,7 @@
1506
1614
  "CVE-2021-22175",
1507
1615
  "CVE-2021-22555",
1508
1616
  "CVE-2021-22681",
1617
+ "CVE-2021-26086",
1509
1618
  "CVE-2021-26828",
1510
1619
  "CVE-2021-26829",
1511
1620
  "CVE-2021-30952",
@@ -1517,14 +1626,21 @@
1517
1626
  "CVE-2021-43798",
1518
1627
  "CVE-2022-1471",
1519
1628
  "CVE-2022-20775",
1629
+ "CVE-2022-23227",
1630
+ "CVE-2022-23748",
1520
1631
  "CVE-2022-37055",
1521
1632
  "CVE-2022-40799",
1633
+ "CVE-2022-43769",
1634
+ "CVE-2022-43939",
1522
1635
  "CVE-2022-48503",
1523
1636
  "CVE-2023-0386",
1637
+ "CVE-2023-20118",
1524
1638
  "CVE-2023-21529",
1525
1639
  "CVE-2023-2533",
1526
1640
  "CVE-2023-27351",
1641
+ "CVE-2023-28461",
1527
1642
  "CVE-2023-33538",
1643
+ "CVE-2023-34192",
1528
1644
  "CVE-2023-36424",
1529
1645
  "CVE-2023-38950",
1530
1646
  "CVE-2023-39780",
@@ -1534,6 +1650,7 @@
1534
1650
  "CVE-2023-44221",
1535
1651
  "CVE-2023-44467",
1536
1652
  "CVE-2023-44487",
1653
+ "CVE-2023-48365",
1537
1654
  "CVE-2023-50224",
1538
1655
  "CVE-2023-50387",
1539
1656
  "CVE-2023-50868",
@@ -1553,9 +1670,14 @@
1553
1670
  "CVE-2024-11394",
1554
1671
  "CVE-2024-12987",
1555
1672
  "CVE-2024-13059",
1673
+ "CVE-2024-13159",
1674
+ "CVE-2024-13160",
1675
+ "CVE-2024-13161",
1556
1676
  "CVE-2024-1561",
1557
1677
  "CVE-2024-1708",
1558
1678
  "CVE-2024-20439",
1679
+ "CVE-2024-20953",
1680
+ "CVE-2024-21287",
1559
1681
  "CVE-2024-21513",
1560
1682
  "CVE-2024-21575",
1561
1683
  "CVE-2024-21576",
@@ -1563,30 +1685,45 @@
1563
1685
  "CVE-2024-27132",
1564
1686
  "CVE-2024-27199",
1565
1687
  "CVE-2024-27443",
1688
+ "CVE-2024-35250",
1566
1689
  "CVE-2024-37032",
1567
1690
  "CVE-2024-37079",
1691
+ "CVE-2024-38094",
1568
1692
  "CVE-2024-38475",
1569
1693
  "CVE-2024-39722",
1570
1694
  "CVE-2024-42009",
1571
1695
  "CVE-2024-42478",
1572
1696
  "CVE-2024-42479",
1573
1697
  "CVE-2024-43468",
1698
+ "CVE-2024-44309",
1574
1699
  "CVE-2024-48248",
1700
+ "CVE-2024-4885",
1575
1701
  "CVE-2024-4889",
1702
+ "CVE-2024-49035",
1576
1703
  "CVE-2024-50050",
1704
+ "CVE-2024-50302",
1705
+ "CVE-2024-51567",
1577
1706
  "CVE-2024-53150",
1578
1707
  "CVE-2024-53197",
1708
+ "CVE-2024-53704",
1579
1709
  "CVE-2024-54085",
1580
1710
  "CVE-2024-56145",
1581
1711
  "CVE-2024-57726",
1712
+ "CVE-2024-57727",
1582
1713
  "CVE-2024-57728",
1714
+ "CVE-2024-57968",
1583
1715
  "CVE-2024-58136",
1584
1716
  "CVE-2024-6047",
1585
1717
  "CVE-2024-6587",
1586
1718
  "CVE-2024-7399",
1719
+ "CVE-2024-7593",
1587
1720
  "CVE-2024-7694",
1588
1721
  "CVE-2024-8068",
1589
1722
  "CVE-2024-8069",
1723
+ "CVE-2024-8963",
1724
+ "CVE-2024-9463",
1725
+ "CVE-2024-9465",
1726
+ "CVE-2025-0111",
1590
1727
  "CVE-2025-0282",
1591
1728
  "CVE-2025-10035",
1592
1729
  "CVE-2025-10585",
@@ -1610,6 +1747,8 @@
1610
1747
  "CVE-2025-20393",
1611
1748
  "CVE-2025-21042",
1612
1749
  "CVE-2025-21043",
1750
+ "CVE-2025-21391",
1751
+ "CVE-2025-21418",
1613
1752
  "CVE-2025-21479",
1614
1753
  "CVE-2025-21480",
1615
1754
  "CVE-2025-21590",
@@ -1617,6 +1756,7 @@
1617
1756
  "CVE-2025-23254",
1618
1757
  "CVE-2025-24016",
1619
1758
  "CVE-2025-24054",
1759
+ "CVE-2025-24085",
1620
1760
  "CVE-2025-24201",
1621
1761
  "CVE-2025-24472",
1622
1762
  "CVE-2025-24813",
@@ -1624,11 +1764,14 @@
1624
1764
  "CVE-2025-24983",
1625
1765
  "CVE-2025-24984",
1626
1766
  "CVE-2025-24985",
1767
+ "CVE-2025-24989",
1627
1768
  "CVE-2025-24990",
1628
1769
  "CVE-2025-24991",
1629
1770
  "CVE-2025-24993",
1771
+ "CVE-2025-25181",
1630
1772
  "CVE-2025-25257",
1631
1773
  "CVE-2025-26399",
1774
+ "CVE-2025-26633",
1632
1775
  "CVE-2025-27038",
1633
1776
  "CVE-2025-27363",
1634
1777
  "CVE-2025-2746",
@@ -1838,15 +1981,20 @@
1838
1981
  "CVE-2026-42945",
1839
1982
  "CVE-2026-45247",
1840
1983
  "CVE-2026-45498",
1984
+ "CVE-2026-45659",
1841
1985
  "CVE-2026-45829",
1842
1986
  "CVE-2026-46300",
1843
1987
  "CVE-2026-46333",
1844
1988
  "CVE-2026-48027",
1845
1989
  "CVE-2026-48172",
1990
+ "CVE-2026-48282",
1991
+ "CVE-2026-48558",
1846
1992
  "CVE-2026-48907",
1993
+ "CVE-2026-48908",
1847
1994
  "CVE-2026-50751",
1848
1995
  "CVE-2026-5281",
1849
1996
  "CVE-2026-54420",
1997
+ "CVE-2026-56291",
1850
1998
  "CVE-2026-9082"
1851
1999
  ],
1852
2000
  "atlas_refs": [],
@@ -1911,7 +2059,7 @@
1911
2059
  "LLM-API-as-C2 (SesameOp pattern, ATLAS AML.T0096) is not in the clause 6.1.2 example threat list — risk register templates omit it",
1912
2060
  "No requirement to link AI risk register entries to specific TTP IDs (ATLAS / ATT&CK) — risks remain framework-internal abstractions"
1913
2061
  ],
1914
- "real_requirement": "Clause 6.1.2 risk registers must (1) ingest ATLAS v2026.05 TTPs as enumerated AI-specific threat sources, (2) cross-reference jurisdictional obligations (EU AI Act Annex III, NIS2 Art. 21, DORA Art. 28, UK CAF B4, AU ISM AI annex, ISO 27001:2022 A.5.7), (3) include AI-API-as-C2 and prompt-injection-as-RCE as named scenarios, (4) be re-run on threat-intel triggers, not only on calendar cycles.",
2062
+ "real_requirement": "Clause 6.1.2 risk registers must (1) ingest ATLAS v2026.06 TTPs as enumerated AI-specific threat sources, (2) cross-reference jurisdictional obligations (EU AI Act Annex III, NIS2 Art. 21, DORA Art. 28, UK CAF B4, AU ISM AI annex, ISO 27001:2022 A.5.7), (3) include AI-API-as-C2 and prompt-injection-as-RCE as named scenarios, (4) be re-run on threat-intel triggers, not only on calendar cycles.",
1915
2063
  "status": "open",
1916
2064
  "opened_date": "2026-05-11",
1917
2065
  "evidence_cves": [],
@@ -1990,6 +2138,13 @@
1990
2138
  "status": "open",
1991
2139
  "opened_date": "2026-05-13",
1992
2140
  "evidence_cves": [
2141
+ "CVE-2024-38094",
2142
+ "CVE-2024-43451",
2143
+ "CVE-2024-49039",
2144
+ "CVE-2024-51567",
2145
+ "CVE-2024-55591",
2146
+ "CVE-2024-55956",
2147
+ "CVE-2025-21391",
1993
2148
  "CVE-2026-39987",
1994
2149
  "CVE-2026-42208",
1995
2150
  "CVE-2026-42897"
@@ -2028,6 +2183,8 @@
2028
2183
  "status": "open",
2029
2184
  "opened_date": "2026-03-15",
2030
2185
  "evidence_cves": [
2186
+ "CVE-2020-15415",
2187
+ "CVE-2021-41277",
2031
2188
  "CVE-2022-1471",
2032
2189
  "CVE-2023-43654",
2033
2190
  "CVE-2023-44467",
@@ -2042,15 +2199,20 @@
2042
2199
  "CVE-2024-11394",
2043
2200
  "CVE-2024-13059",
2044
2201
  "CVE-2024-1561",
2202
+ "CVE-2024-21413",
2045
2203
  "CVE-2024-21513",
2046
2204
  "CVE-2024-21575",
2047
2205
  "CVE-2024-21576",
2048
2206
  "CVE-2024-27132",
2207
+ "CVE-2024-30088",
2208
+ "CVE-2024-35250",
2049
2209
  "CVE-2024-37032",
2050
2210
  "CVE-2024-39722",
2211
+ "CVE-2024-40711",
2051
2212
  "CVE-2024-42478",
2052
2213
  "CVE-2024-42479",
2053
2214
  "CVE-2024-4889",
2215
+ "CVE-2024-49138",
2054
2216
  "CVE-2024-50050",
2055
2217
  "CVE-2024-6587",
2056
2218
  "CVE-2025-10585",
@@ -2257,6 +2419,7 @@
2257
2419
  "status": "open",
2258
2420
  "opened_date": "2026-03-01",
2259
2421
  "evidence_cves": [
2422
+ "CVE-2024-28987",
2260
2423
  "CVE-2025-53773"
2261
2424
  ],
2262
2425
  "atlas_refs": [
@@ -2293,13 +2456,28 @@
2293
2456
  "opened_date": "2026-04-01",
2294
2457
  "evidence_cves": [
2295
2458
  "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
2459
+ "CVE-2018-14933",
2460
+ "CVE-2019-16278",
2461
+ "CVE-2022-23227",
2462
+ "CVE-2022-23748",
2463
+ "CVE-2023-25280",
2296
2464
  "CVE-2023-6016",
2297
2465
  "CVE-2024-12366",
2298
2466
  "CVE-2024-24590",
2299
2467
  "CVE-2024-24591",
2468
+ "CVE-2024-29059",
2300
2469
  "CVE-2024-2912",
2301
2470
  "CVE-2024-3154",
2471
+ "CVE-2024-40891",
2472
+ "CVE-2024-43093",
2473
+ "CVE-2024-43572",
2474
+ "CVE-2024-44308",
2475
+ "CVE-2024-53104",
2302
2476
  "CVE-2024-5565",
2477
+ "CVE-2024-55956",
2478
+ "CVE-2024-9537",
2479
+ "CVE-2025-0411",
2480
+ "CVE-2025-24085",
2303
2481
  "CVE-2025-27520",
2304
2482
  "CVE-2025-3248",
2305
2483
  "CVE-2025-3466",
@@ -2315,6 +2493,7 @@
2315
2493
  "CVE-2026-42271",
2316
2494
  "CVE-2026-45247",
2317
2495
  "CVE-2026-48172",
2496
+ "CVE-2026-56290",
2318
2497
  "CVE-2026-8398"
2319
2498
  ],
2320
2499
  "atlas_refs": [
@@ -2460,25 +2639,52 @@
2460
2639
  "status": "open",
2461
2640
  "opened_date": "2026-05-01",
2462
2641
  "evidence_cves": [
2642
+ "CVE-2019-0344",
2643
+ "CVE-2020-15069",
2644
+ "CVE-2020-15415",
2645
+ "CVE-2020-2883",
2463
2646
  "CVE-2021-20035",
2464
2647
  "CVE-2022-36551",
2465
2648
  "CVE-2023-44221",
2649
+ "CVE-2023-45727",
2466
2650
  "CVE-2023-48022",
2467
2651
  "CVE-2023-51449",
2468
2652
  "CVE-2023-6038",
2653
+ "CVE-2024-0012",
2469
2654
  "CVE-2024-0132",
2470
2655
  "CVE-2024-11120",
2656
+ "CVE-2024-11667",
2657
+ "CVE-2024-1212",
2658
+ "CVE-2024-12356",
2471
2659
  "CVE-2024-12450",
2472
2660
  "CVE-2024-1561",
2661
+ "CVE-2024-20481",
2662
+ "CVE-2024-20767",
2473
2663
  "CVE-2024-21182",
2664
+ "CVE-2024-21413",
2474
2665
  "CVE-2024-21575",
2475
2666
  "CVE-2024-21576",
2667
+ "CVE-2024-23113",
2668
+ "CVE-2024-38812",
2476
2669
  "CVE-2024-40635",
2670
+ "CVE-2024-40890",
2671
+ "CVE-2024-41713",
2477
2672
  "CVE-2024-42478",
2478
2673
  "CVE-2024-42479",
2674
+ "CVE-2024-43451",
2675
+ "CVE-2024-45519",
2676
+ "CVE-2024-50603",
2677
+ "CVE-2024-50623",
2678
+ "CVE-2024-55591",
2479
2679
  "CVE-2024-6047",
2680
+ "CVE-2024-8956",
2681
+ "CVE-2024-8963",
2682
+ "CVE-2024-9474",
2683
+ "CVE-2024-9680",
2684
+ "CVE-2025-0108",
2480
2685
  "CVE-2025-1976",
2481
2686
  "CVE-2025-21590",
2687
+ "CVE-2025-23006",
2482
2688
  "CVE-2025-23266",
2483
2689
  "CVE-2025-24472",
2484
2690
  "CVE-2025-25297",
@@ -2498,6 +2704,7 @@
2498
2704
  "CVE-2026-34909",
2499
2705
  "CVE-2026-34910",
2500
2706
  "CVE-2026-42897",
2707
+ "CVE-2026-48282",
2501
2708
  "CVE-2026-50751",
2502
2709
  "CVE-2026-5760",
2503
2710
  "CVE-2026-7473"
@@ -2718,6 +2925,7 @@
2718
2925
  "CVE-2012-1854",
2719
2926
  "CVE-2013-3893",
2720
2927
  "CVE-2013-3918",
2928
+ "CVE-2014-2120",
2721
2929
  "CVE-2014-3931",
2722
2930
  "CVE-2014-6278",
2723
2931
  "CVE-2015-7755",
@@ -2725,19 +2933,28 @@
2725
2933
  "CVE-2016-7836",
2726
2934
  "CVE-2017-1000353",
2727
2935
  "CVE-2017-12637",
2936
+ "CVE-2017-3066",
2728
2937
  "CVE-2017-7921",
2729
2938
  "CVE-2018-14634",
2939
+ "CVE-2018-14933",
2730
2940
  "CVE-2018-4063",
2941
+ "CVE-2018-8639",
2942
+ "CVE-2019-0344",
2943
+ "CVE-2019-11001",
2731
2944
  "CVE-2019-19006",
2732
2945
  "CVE-2019-5418",
2733
2946
  "CVE-2019-6693",
2734
2947
  "CVE-2019-9621",
2735
2948
  "CVE-2019-9874",
2736
2949
  "CVE-2019-9875",
2950
+ "CVE-2020-11023",
2951
+ "CVE-2020-15415",
2737
2952
  "CVE-2020-17103-REREGRESSION-2026",
2738
2953
  "CVE-2020-24363",
2739
2954
  "CVE-2020-25078",
2740
2955
  "CVE-2020-25079",
2956
+ "CVE-2020-2883",
2957
+ "CVE-2020-29574",
2741
2958
  "CVE-2020-7796",
2742
2959
  "CVE-2020-9715",
2743
2960
  "CVE-2021-20035",
@@ -2746,6 +2963,7 @@
2746
2963
  "CVE-2021-22175",
2747
2964
  "CVE-2021-22555",
2748
2965
  "CVE-2021-22681",
2966
+ "CVE-2021-26086",
2749
2967
  "CVE-2021-26828",
2750
2968
  "CVE-2021-26829",
2751
2969
  "CVE-2021-30952",
@@ -2753,19 +2971,29 @@
2753
2971
  "CVE-2021-33515",
2754
2972
  "CVE-2021-38371",
2755
2973
  "CVE-2021-39935",
2974
+ "CVE-2021-40407",
2975
+ "CVE-2021-41277",
2756
2976
  "CVE-2021-43226",
2757
2977
  "CVE-2021-43798",
2978
+ "CVE-2021-44207",
2758
2979
  "CVE-2022-0492",
2759
2980
  "CVE-2022-1471",
2760
2981
  "CVE-2022-20775",
2982
+ "CVE-2022-23748",
2761
2983
  "CVE-2022-37055",
2762
2984
  "CVE-2022-40799",
2985
+ "CVE-2022-43769",
2986
+ "CVE-2022-43939",
2763
2987
  "CVE-2022-48503",
2764
2988
  "CVE-2023-0386",
2989
+ "CVE-2023-20118",
2765
2990
  "CVE-2023-21529",
2991
+ "CVE-2023-25280",
2766
2992
  "CVE-2023-2533",
2767
2993
  "CVE-2023-27351",
2994
+ "CVE-2023-28461",
2768
2995
  "CVE-2023-33538",
2996
+ "CVE-2023-34192",
2769
2997
  "CVE-2023-3519",
2770
2998
  "CVE-2023-36424",
2771
2999
  "CVE-2023-38950",
@@ -2776,6 +3004,8 @@
2776
3004
  "CVE-2023-44221",
2777
3005
  "CVE-2023-44467",
2778
3006
  "CVE-2023-44487",
3007
+ "CVE-2023-45727",
3008
+ "CVE-2023-48365",
2779
3009
  "CVE-2023-50224",
2780
3010
  "CVE-2023-50387",
2781
3011
  "CVE-2023-50868",
@@ -2794,38 +3024,78 @@
2794
3024
  "CVE-2024-11392",
2795
3025
  "CVE-2024-11393",
2796
3026
  "CVE-2024-11394",
3027
+ "CVE-2024-11667",
3028
+ "CVE-2024-1212",
3029
+ "CVE-2024-12356",
3030
+ "CVE-2024-12686",
2797
3031
  "CVE-2024-12987",
2798
3032
  "CVE-2024-13059",
3033
+ "CVE-2024-13159",
3034
+ "CVE-2024-13160",
3035
+ "CVE-2024-13161",
2799
3036
  "CVE-2024-1561",
2800
3037
  "CVE-2024-1708",
2801
3038
  "CVE-2024-20439",
3039
+ "CVE-2024-20767",
3040
+ "CVE-2024-20953",
2802
3041
  "CVE-2024-21182",
3042
+ "CVE-2024-21287",
3043
+ "CVE-2024-21413",
2803
3044
  "CVE-2024-21513",
2804
3045
  "CVE-2024-21575",
2805
3046
  "CVE-2024-21576",
2806
3047
  "CVE-2024-21762",
3048
+ "CVE-2024-23113",
2807
3049
  "CVE-2024-27132",
2808
3050
  "CVE-2024-27199",
2809
3051
  "CVE-2024-27443",
3052
+ "CVE-2024-29824",
3053
+ "CVE-2024-30088",
3054
+ "CVE-2024-3393",
3055
+ "CVE-2024-35250",
2810
3056
  "CVE-2024-37032",
2811
3057
  "CVE-2024-37052",
2812
3058
  "CVE-2024-37060",
2813
3059
  "CVE-2024-37079",
3060
+ "CVE-2024-38094",
2814
3061
  "CVE-2024-38475",
3062
+ "CVE-2024-38812",
3063
+ "CVE-2024-38813",
2815
3064
  "CVE-2024-39722",
3065
+ "CVE-2024-40711",
3066
+ "CVE-2024-40890",
3067
+ "CVE-2024-40891",
3068
+ "CVE-2024-41713",
2816
3069
  "CVE-2024-42009",
2817
3070
  "CVE-2024-42478",
2818
3071
  "CVE-2024-42479",
3072
+ "CVE-2024-43047",
2819
3073
  "CVE-2024-43468",
3074
+ "CVE-2024-43572",
3075
+ "CVE-2024-43573",
3076
+ "CVE-2024-44308",
3077
+ "CVE-2024-44309",
3078
+ "CVE-2024-45519",
2820
3079
  "CVE-2024-48248",
3080
+ "CVE-2024-4885",
2821
3081
  "CVE-2024-4889",
3082
+ "CVE-2024-49035",
3083
+ "CVE-2024-49039",
3084
+ "CVE-2024-49138",
2822
3085
  "CVE-2024-50050",
3086
+ "CVE-2024-50302",
3087
+ "CVE-2024-50603",
3088
+ "CVE-2024-50623",
3089
+ "CVE-2024-51378",
2823
3090
  "CVE-2024-53150",
2824
3091
  "CVE-2024-53197",
2825
3092
  "CVE-2024-54085",
3093
+ "CVE-2024-55550",
3094
+ "CVE-2024-55956",
2826
3095
  "CVE-2024-56145",
2827
3096
  "CVE-2024-57726",
2828
3097
  "CVE-2024-57728",
3098
+ "CVE-2024-57968",
2829
3099
  "CVE-2024-58136",
2830
3100
  "CVE-2024-6047",
2831
3101
  "CVE-2024-6587",
@@ -2833,7 +3103,16 @@
2833
3103
  "CVE-2024-7694",
2834
3104
  "CVE-2024-8068",
2835
3105
  "CVE-2024-8069",
3106
+ "CVE-2024-9379",
3107
+ "CVE-2024-9380",
3108
+ "CVE-2024-9463",
3109
+ "CVE-2024-9465",
3110
+ "CVE-2024-9474",
3111
+ "CVE-2024-9537",
3112
+ "CVE-2024-9680",
3113
+ "CVE-2025-0111",
2836
3114
  "CVE-2025-0282",
3115
+ "CVE-2025-0994",
2837
3116
  "CVE-2025-10035",
2838
3117
  "CVE-2025-10164",
2839
3118
  "CVE-2025-10585",
@@ -2858,10 +3137,16 @@
2858
3137
  "CVE-2025-20393",
2859
3138
  "CVE-2025-21042",
2860
3139
  "CVE-2025-21043",
3140
+ "CVE-2025-21333",
3141
+ "CVE-2025-21334",
3142
+ "CVE-2025-21335",
3143
+ "CVE-2025-21418",
2861
3144
  "CVE-2025-21479",
2862
3145
  "CVE-2025-21480",
2863
3146
  "CVE-2025-21590",
2864
3147
  "CVE-2025-22457",
3148
+ "CVE-2025-23006",
3149
+ "CVE-2025-23209",
2865
3150
  "CVE-2025-23254",
2866
3151
  "CVE-2025-23266",
2867
3152
  "CVE-2025-24016",
@@ -2873,11 +3158,14 @@
2873
3158
  "CVE-2025-24983",
2874
3159
  "CVE-2025-24984",
2875
3160
  "CVE-2025-24985",
3161
+ "CVE-2025-24989",
2876
3162
  "CVE-2025-24990",
2877
3163
  "CVE-2025-24991",
2878
3164
  "CVE-2025-24993",
3165
+ "CVE-2025-25181",
2879
3166
  "CVE-2025-25257",
2880
3167
  "CVE-2025-26399",
3168
+ "CVE-2025-26633",
2881
3169
  "CVE-2025-27038",
2882
3170
  "CVE-2025-27363",
2883
3171
  "CVE-2025-2746",
@@ -3100,13 +3388,19 @@
3100
3388
  "CVE-2026-43500",
3101
3389
  "CVE-2026-45247",
3102
3390
  "CVE-2026-45498",
3391
+ "CVE-2026-45659",
3103
3392
  "CVE-2026-45829",
3104
3393
  "CVE-2026-46300",
3105
3394
  "CVE-2026-46333",
3395
+ "CVE-2026-48282",
3396
+ "CVE-2026-48558",
3106
3397
  "CVE-2026-48907",
3398
+ "CVE-2026-48908",
3399
+ "CVE-2026-48939",
3107
3400
  "CVE-2026-50751",
3108
3401
  "CVE-2026-5281",
3109
3402
  "CVE-2026-54420",
3403
+ "CVE-2026-56291",
3110
3404
  "CVE-2026-6973",
3111
3405
  "CVE-2026-7473",
3112
3406
  "CVE-2026-9082"
@@ -3145,8 +3439,13 @@
3145
3439
  "CVE-2023-6571",
3146
3440
  "CVE-2024-12366",
3147
3441
  "CVE-2024-2912",
3442
+ "CVE-2024-37383",
3443
+ "CVE-2024-43047",
3444
+ "CVE-2024-43573",
3148
3445
  "CVE-2024-5565",
3446
+ "CVE-2024-8957",
3149
3447
  "CVE-2024-9526",
3448
+ "CVE-2025-0411",
3150
3449
  "CVE-2025-11837",
3151
3450
  "CVE-2025-27363",
3152
3451
  "CVE-2025-27520",
@@ -3240,7 +3539,9 @@
3240
3539
  "real_requirement": "800-63B Rev 4 must add an AAL-A (agent assurance level) construct: per-invocation authenticator binding, capability-scoped tokens (what this agent is permitted to do this run), agent-to-agent delegation chains with non-repudiation, and explicit cross-walk to eIDAS 2.0 attestations, UK GPG 45, AU TDIF, and ISO 29115 for cross-border agent identity.",
3241
3540
  "status": "open",
3242
3541
  "opened_date": "2026-05-11",
3243
- "evidence_cves": [],
3542
+ "evidence_cves": [
3543
+ "CVE-2024-28987"
3544
+ ],
3244
3545
  "atlas_refs": [
3245
3546
  "AML.T0051",
3246
3547
  "AML.T0054"
@@ -3648,6 +3949,8 @@
3648
3949
  "CVE-2023-51765",
3649
3950
  "CVE-2023-51766",
3650
3951
  "CVE-2024-21762",
3952
+ "CVE-2024-29824",
3953
+ "CVE-2024-9379",
3651
3954
  "CVE-2025-0282",
3652
3955
  "CVE-2025-22457",
3653
3956
  "CVE-2025-31161",
@@ -4006,7 +4309,9 @@
4006
4309
  "real_requirement": "CC7 anomaly detection must include AI-specific threat signatures: baseline expected AI API usage per system/process, alert on AI API queries from security-sensitive processes, monitor AI tool action logs for out-of-scope actions, include AI-as-C2 in threat model.",
4007
4310
  "status": "open",
4008
4311
  "opened_date": "2026-02-01",
4009
- "evidence_cves": [],
4312
+ "evidence_cves": [
4313
+ "CVE-2024-9537"
4314
+ ],
4010
4315
  "atlas_refs": [
4011
4316
  "AML.T0096",
4012
4317
  "AML.T0017"
@@ -4180,6 +4485,9 @@
4180
4485
  "status": "open",
4181
4486
  "opened_date": "2026-05-13",
4182
4487
  "evidence_cves": [
4488
+ "CVE-2018-19410",
4489
+ "CVE-2018-9276",
4490
+ "CVE-2020-2883",
4183
4491
  "CVE-2022-1471",
4184
4492
  "CVE-2023-43654",
4185
4493
  "CVE-2023-43791",
@@ -4187,9 +4495,15 @@
4187
4495
  "CVE-2023-48022",
4188
4496
  "CVE-2023-6019",
4189
4497
  "CVE-2023-6021",
4498
+ "CVE-2024-0012",
4190
4499
  "CVE-2024-12776",
4500
+ "CVE-2024-45195",
4191
4501
  "CVE-2024-4889",
4502
+ "CVE-2024-49138",
4503
+ "CVE-2024-57727",
4192
4504
  "CVE-2024-6587",
4505
+ "CVE-2024-7593",
4506
+ "CVE-2024-8956",
4193
4507
  "CVE-2025-1796",
4194
4508
  "CVE-2025-64513",
4195
4509
  "CVE-2025-69286",
@@ -4200,7 +4514,9 @@
4200
4514
  "CVE-2026-26190",
4201
4515
  "CVE-2026-41947",
4202
4516
  "CVE-2026-41950",
4203
- "CVE-2026-50751"
4517
+ "CVE-2026-50751",
4518
+ "CVE-2026-55255",
4519
+ "CVE-2026-56290"
4204
4520
  ],
4205
4521
  "atlas_refs": [
4206
4522
  "AML.T0010",
@@ -4235,7 +4551,13 @@
4235
4551
  "real_requirement": "Security monitoring includes prompt/response content classification on egress to AI providers, MCP tool-call audit trail (model decision + tool name + arguments + result), AI-API traffic baselines per service identity with anomaly alerts, and unified retention covering AI events alongside classical telemetry.",
4236
4552
  "status": "open",
4237
4553
  "opened_date": "2026-05-13",
4238
- "evidence_cves": [],
4554
+ "evidence_cves": [
4555
+ "CVE-2014-2120",
4556
+ "CVE-2024-38094",
4557
+ "CVE-2024-41710",
4558
+ "CVE-2024-49039",
4559
+ "CVE-2025-0994"
4560
+ ],
4239
4561
  "atlas_refs": [
4240
4562
  "AML.T0096",
4241
4563
  "AML.T0024",
@@ -4270,7 +4592,13 @@
4270
4592
  "real_requirement": "Response plans include live kernel patching as a documented capability with operator drill cadence; AI-incident playbooks cover model rollback, prompt classifier updates, MCP allowlist tightening; backups validate AI-system artefacts; recovery clocks align to NIS2 24h + DORA 4h + GDPR 72h notification matrix.",
4271
4593
  "status": "open",
4272
4594
  "opened_date": "2026-05-13",
4273
- "evidence_cves": [],
4595
+ "evidence_cves": [
4596
+ "CVE-2024-20481",
4597
+ "CVE-2024-3393",
4598
+ "CVE-2024-51567",
4599
+ "CVE-2025-21391",
4600
+ "CVE-2025-21418"
4601
+ ],
4274
4602
  "atlas_refs": [],
4275
4603
  "attack_refs": [
4276
4604
  "T1068"
@@ -5373,27 +5701,94 @@
5373
5701
  "opened_date": "2026-05-15",
5374
5702
  "evidence_cves": [
5375
5703
  "CVE-2017-12637",
5704
+ "CVE-2017-3066",
5705
+ "CVE-2018-14933",
5706
+ "CVE-2018-19410",
5707
+ "CVE-2018-8639",
5708
+ "CVE-2018-9276",
5709
+ "CVE-2019-0344",
5710
+ "CVE-2019-11001",
5376
5711
  "CVE-2019-9874",
5377
5712
  "CVE-2019-9875",
5713
+ "CVE-2020-11023",
5714
+ "CVE-2020-15069",
5715
+ "CVE-2020-29574",
5716
+ "CVE-2021-26086",
5717
+ "CVE-2021-44207",
5718
+ "CVE-2022-23227",
5719
+ "CVE-2022-43769",
5720
+ "CVE-2022-43939",
5721
+ "CVE-2023-20118",
5722
+ "CVE-2023-28461",
5723
+ "CVE-2023-34192",
5378
5724
  "CVE-2023-3519",
5725
+ "CVE-2023-45727",
5379
5726
  "CVE-2023-6571",
5727
+ "CVE-2024-0012",
5728
+ "CVE-2024-11680",
5380
5729
  "CVE-2024-12366",
5730
+ "CVE-2024-12686",
5731
+ "CVE-2024-13159",
5732
+ "CVE-2024-13160",
5733
+ "CVE-2024-13161",
5381
5734
  "CVE-2024-20439",
5735
+ "CVE-2024-20767",
5736
+ "CVE-2024-20953",
5737
+ "CVE-2024-21287",
5738
+ "CVE-2024-28987",
5739
+ "CVE-2024-29059",
5382
5740
  "CVE-2024-2912",
5741
+ "CVE-2024-29824",
5383
5742
  "CVE-2024-38475",
5743
+ "CVE-2024-38813",
5744
+ "CVE-2024-40890",
5745
+ "CVE-2024-40891",
5746
+ "CVE-2024-41710",
5747
+ "CVE-2024-41713",
5748
+ "CVE-2024-43047",
5749
+ "CVE-2024-43093",
5750
+ "CVE-2024-43572",
5751
+ "CVE-2024-43573",
5752
+ "CVE-2024-44308",
5753
+ "CVE-2024-44309",
5384
5754
  "CVE-2024-48248",
5755
+ "CVE-2024-4885",
5756
+ "CVE-2024-49035",
5757
+ "CVE-2024-50302",
5758
+ "CVE-2024-53104",
5385
5759
  "CVE-2024-53150",
5386
5760
  "CVE-2024-53197",
5761
+ "CVE-2024-55550",
5387
5762
  "CVE-2024-5565",
5763
+ "CVE-2024-57727",
5764
+ "CVE-2024-57968",
5388
5765
  "CVE-2024-58136",
5766
+ "CVE-2024-7593",
5767
+ "CVE-2024-8956",
5768
+ "CVE-2024-8957",
5769
+ "CVE-2024-9379",
5770
+ "CVE-2024-9380",
5389
5771
  "CVE-2024-9526",
5772
+ "CVE-2024-9537",
5773
+ "CVE-2025-0111",
5774
+ "CVE-2025-0411",
5775
+ "CVE-2025-21333",
5776
+ "CVE-2025-21334",
5777
+ "CVE-2025-21335",
5778
+ "CVE-2025-21418",
5779
+ "CVE-2025-23006",
5780
+ "CVE-2025-23209",
5390
5781
  "CVE-2025-24054",
5782
+ "CVE-2025-24085",
5391
5783
  "CVE-2025-24813",
5392
5784
  "CVE-2025-24983",
5393
5785
  "CVE-2025-24984",
5394
5786
  "CVE-2025-24985",
5787
+ "CVE-2025-24989",
5395
5788
  "CVE-2025-24991",
5396
5789
  "CVE-2025-24993",
5790
+ "CVE-2025-25181",
5791
+ "CVE-2025-26633",
5397
5792
  "CVE-2025-27520",
5398
5793
  "CVE-2025-2783",
5399
5794
  "CVE-2025-29824",
@@ -5409,8 +5804,14 @@
5409
5804
  "CVE-2026-12569",
5410
5805
  "CVE-2026-20253",
5411
5806
  "CVE-2026-42945",
5807
+ "CVE-2026-45659",
5808
+ "CVE-2026-48282",
5809
+ "CVE-2026-48558",
5412
5810
  "CVE-2026-48907",
5413
- "CVE-2026-54420"
5811
+ "CVE-2026-48908",
5812
+ "CVE-2026-54420",
5813
+ "CVE-2026-55255",
5814
+ "CVE-2026-56291"
5414
5815
  ],
5415
5816
  "atlas_refs": [],
5416
5817
  "attack_refs": [
@@ -5461,6 +5862,7 @@
5461
5862
  "CVE-2023-6021",
5462
5863
  "CVE-2023-6038",
5463
5864
  "CVE-2023-6571",
5865
+ "CVE-2024-0012",
5464
5866
  "CVE-2024-0129",
5465
5867
  "CVE-2024-0132",
5466
5868
  "CVE-2024-11392",
@@ -5487,9 +5889,11 @@
5487
5889
  "CVE-2024-39722",
5488
5890
  "CVE-2024-42478",
5489
5891
  "CVE-2024-42479",
5892
+ "CVE-2024-47575",
5490
5893
  "CVE-2024-4889",
5491
5894
  "CVE-2024-50050",
5492
5895
  "CVE-2024-5565",
5896
+ "CVE-2024-55956",
5493
5897
  "CVE-2024-6587",
5494
5898
  "CVE-2024-9526",
5495
5899
  "CVE-2025-0282",
@@ -5610,16 +6014,27 @@
5610
6014
  "status": "open",
5611
6015
  "opened_date": "2026-05-15",
5612
6016
  "evidence_cves": [
6017
+ "CVE-2020-29574",
6018
+ "CVE-2021-41277",
5613
6019
  "CVE-2022-0492",
5614
6020
  "CVE-2022-36551",
5615
6021
  "CVE-2023-43791",
5616
6022
  "CVE-2023-47117",
5617
6023
  "CVE-2023-6038",
6024
+ "CVE-2024-0012",
6025
+ "CVE-2024-11680",
5618
6026
  "CVE-2024-12776",
5619
6027
  "CVE-2024-1709",
5620
6028
  "CVE-2024-21182",
6029
+ "CVE-2024-21287",
5621
6030
  "CVE-2024-31462",
6031
+ "CVE-2024-45195",
6032
+ "CVE-2024-47575",
6033
+ "CVE-2024-51378",
6034
+ "CVE-2024-51567",
6035
+ "CVE-2024-57727",
5622
6036
  "CVE-2025-1796",
6037
+ "CVE-2025-24200",
5623
6038
  "CVE-2025-25297",
5624
6039
  "CVE-2025-3248",
5625
6040
  "CVE-2025-3466",
@@ -5641,6 +6056,7 @@
5641
6056
  "CVE-2026-45247",
5642
6057
  "CVE-2026-48172",
5643
6058
  "CVE-2026-50751",
6059
+ "CVE-2026-55255",
5644
6060
  "CVE-2026-7482"
5645
6061
  ],
5646
6062
  "atlas_refs": [
@@ -5736,6 +6152,8 @@
5736
6152
  "CVE-2017-1000353",
5737
6153
  "CVE-2017-7921",
5738
6154
  "CVE-2018-4063",
6155
+ "CVE-2018-9276",
6156
+ "CVE-2019-11001",
5739
6157
  "CVE-2019-19006",
5740
6158
  "CVE-2019-6693",
5741
6159
  "CVE-2020-24363",
@@ -5744,6 +6162,7 @@
5744
6162
  "CVE-2021-22681",
5745
6163
  "CVE-2021-26828",
5746
6164
  "CVE-2021-32030",
6165
+ "CVE-2021-40407",
5747
6166
  "CVE-2022-0492",
5748
6167
  "CVE-2022-37055",
5749
6168
  "CVE-2022-40799",
@@ -5756,14 +6175,27 @@
5756
6175
  "CVE-2023-39780",
5757
6176
  "CVE-2023-50224",
5758
6177
  "CVE-2023-52163",
6178
+ "CVE-2024-12686",
5759
6179
  "CVE-2024-12987",
6180
+ "CVE-2024-30088",
6181
+ "CVE-2024-35250",
5760
6182
  "CVE-2024-37079",
6183
+ "CVE-2024-38094",
6184
+ "CVE-2024-38813",
6185
+ "CVE-2024-40711",
6186
+ "CVE-2024-41710",
5761
6187
  "CVE-2024-43468",
6188
+ "CVE-2024-49138",
5762
6189
  "CVE-2024-54085",
6190
+ "CVE-2024-55550",
5763
6191
  "CVE-2024-56145",
5764
6192
  "CVE-2024-57726",
5765
6193
  "CVE-2024-7694",
5766
6194
  "CVE-2024-8069",
6195
+ "CVE-2024-9380",
6196
+ "CVE-2024-9463",
6197
+ "CVE-2024-9465",
6198
+ "CVE-2025-0994",
5767
6199
  "CVE-2025-10035",
5768
6200
  "CVE-2025-10725",
5769
6201
  "CVE-2025-11371",
@@ -5781,6 +6213,9 @@
5781
6213
  "CVE-2025-20393",
5782
6214
  "CVE-2025-21042",
5783
6215
  "CVE-2025-21043",
6216
+ "CVE-2025-21333",
6217
+ "CVE-2025-21334",
6218
+ "CVE-2025-21335",
5784
6219
  "CVE-2025-24016",
5785
6220
  "CVE-2025-24472",
5786
6221
  "CVE-2025-24893",
@@ -5911,6 +6346,7 @@
5911
6346
  "CVE-2026-48172",
5912
6347
  "CVE-2026-48907",
5913
6348
  "CVE-2026-54420",
6349
+ "CVE-2026-55255",
5914
6350
  "CVE-2026-6973"
5915
6351
  ],
5916
6352
  "atlas_refs": [],
@@ -5991,11 +6427,13 @@
5991
6427
  "opened_date": "2026-05-15",
5992
6428
  "evidence_cves": [
5993
6429
  "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
6430
+ "CVE-2024-53104",
5994
6431
  "CVE-2025-11837",
5995
6432
  "CVE-2025-30400",
5996
6433
  "CVE-2026-11645",
5997
6434
  "CVE-2026-32202",
5998
6435
  "CVE-2026-33825",
6436
+ "CVE-2026-56290",
5999
6437
  "CVE-2026-6973"
6000
6438
  ],
6001
6439
  "atlas_refs": [],
@@ -6120,18 +6558,37 @@
6120
6558
  "evidence_cves": [
6121
6559
  "CVE-2011-0411",
6122
6560
  "CVE-2017-12637",
6561
+ "CVE-2017-3066",
6562
+ "CVE-2018-8639",
6563
+ "CVE-2019-0344",
6564
+ "CVE-2019-16278",
6123
6565
  "CVE-2019-9874",
6124
6566
  "CVE-2019-9875",
6567
+ "CVE-2020-11023",
6568
+ "CVE-2020-15069",
6569
+ "CVE-2020-15415",
6570
+ "CVE-2020-29574",
6125
6571
  "CVE-2021-20035",
6572
+ "CVE-2021-26086",
6126
6573
  "CVE-2021-33515",
6127
6574
  "CVE-2021-38371",
6575
+ "CVE-2021-44207",
6128
6576
  "CVE-2022-0492",
6577
+ "CVE-2022-23748",
6129
6578
  "CVE-2022-23812",
6130
6579
  "CVE-2022-36551",
6580
+ "CVE-2022-43769",
6581
+ "CVE-2022-43939",
6582
+ "CVE-2023-20118",
6583
+ "CVE-2023-25280",
6584
+ "CVE-2023-28461",
6585
+ "CVE-2023-34192",
6131
6586
  "CVE-2023-43791",
6132
6587
  "CVE-2023-44221",
6133
6588
  "CVE-2023-44467",
6589
+ "CVE-2023-45727",
6134
6590
  "CVE-2023-47117",
6591
+ "CVE-2023-48365",
6135
6592
  "CVE-2023-51449",
6136
6593
  "CVE-2023-6016",
6137
6594
  "CVE-2023-6038",
@@ -6142,55 +6599,118 @@
6142
6599
  "CVE-2024-11392",
6143
6600
  "CVE-2024-11393",
6144
6601
  "CVE-2024-11394",
6602
+ "CVE-2024-11667",
6603
+ "CVE-2024-11680",
6604
+ "CVE-2024-1212",
6605
+ "CVE-2024-12356",
6145
6606
  "CVE-2024-12366",
6146
6607
  "CVE-2024-12450",
6608
+ "CVE-2024-12686",
6147
6609
  "CVE-2024-13059",
6610
+ "CVE-2024-13159",
6611
+ "CVE-2024-13160",
6612
+ "CVE-2024-13161",
6148
6613
  "CVE-2024-1561",
6149
6614
  "CVE-2024-20439",
6615
+ "CVE-2024-20767",
6616
+ "CVE-2024-20953",
6150
6617
  "CVE-2024-21182",
6618
+ "CVE-2024-21287",
6619
+ "CVE-2024-21413",
6151
6620
  "CVE-2024-21513",
6152
6621
  "CVE-2024-21575",
6153
6622
  "CVE-2024-21576",
6154
6623
  "CVE-2024-21762",
6624
+ "CVE-2024-23113",
6155
6625
  "CVE-2024-24590",
6156
6626
  "CVE-2024-24591",
6157
6627
  "CVE-2024-27132",
6628
+ "CVE-2024-29059",
6158
6629
  "CVE-2024-2912",
6630
+ "CVE-2024-29824",
6631
+ "CVE-2024-30088",
6159
6632
  "CVE-2024-31462",
6160
6633
  "CVE-2024-37032",
6161
6634
  "CVE-2024-37052",
6162
6635
  "CVE-2024-37060",
6636
+ "CVE-2024-37383",
6163
6637
  "CVE-2024-38475",
6638
+ "CVE-2024-38812",
6639
+ "CVE-2024-38813",
6164
6640
  "CVE-2024-39722",
6641
+ "CVE-2024-40711",
6642
+ "CVE-2024-40890",
6643
+ "CVE-2024-40891",
6644
+ "CVE-2024-41713",
6165
6645
  "CVE-2024-42478",
6166
6646
  "CVE-2024-42479",
6647
+ "CVE-2024-43047",
6648
+ "CVE-2024-43093",
6649
+ "CVE-2024-43451",
6650
+ "CVE-2024-43572",
6651
+ "CVE-2024-43573",
6652
+ "CVE-2024-44308",
6653
+ "CVE-2024-44309",
6654
+ "CVE-2024-45519",
6655
+ "CVE-2024-47575",
6167
6656
  "CVE-2024-48248",
6657
+ "CVE-2024-4885",
6658
+ "CVE-2024-49035",
6168
6659
  "CVE-2024-50050",
6660
+ "CVE-2024-50302",
6661
+ "CVE-2024-50603",
6662
+ "CVE-2024-50623",
6663
+ "CVE-2024-51378",
6664
+ "CVE-2024-53104",
6169
6665
  "CVE-2024-53150",
6170
6666
  "CVE-2024-53197",
6667
+ "CVE-2024-53704",
6668
+ "CVE-2024-55550",
6669
+ "CVE-2024-55591",
6171
6670
  "CVE-2024-5565",
6671
+ "CVE-2024-57968",
6172
6672
  "CVE-2024-58136",
6673
+ "CVE-2024-5910",
6173
6674
  "CVE-2024-6047",
6675
+ "CVE-2024-8957",
6676
+ "CVE-2024-8963",
6677
+ "CVE-2024-9379",
6678
+ "CVE-2024-9380",
6679
+ "CVE-2024-9474",
6174
6680
  "CVE-2024-9526",
6681
+ "CVE-2024-9680",
6682
+ "CVE-2025-0108",
6683
+ "CVE-2025-0111",
6175
6684
  "CVE-2025-0282",
6685
+ "CVE-2025-0411",
6176
6686
  "CVE-2025-10164",
6177
6687
  "CVE-2025-1316",
6178
6688
  "CVE-2025-1550",
6179
6689
  "CVE-2025-1753",
6180
6690
  "CVE-2025-1976",
6691
+ "CVE-2025-21333",
6692
+ "CVE-2025-21334",
6693
+ "CVE-2025-21335",
6181
6694
  "CVE-2025-21590",
6182
6695
  "CVE-2025-22457",
6696
+ "CVE-2025-23006",
6697
+ "CVE-2025-23209",
6183
6698
  "CVE-2025-23254",
6184
6699
  "CVE-2025-23266",
6185
6700
  "CVE-2025-24054",
6701
+ "CVE-2025-24085",
6702
+ "CVE-2025-24200",
6186
6703
  "CVE-2025-24472",
6187
6704
  "CVE-2025-24813",
6188
6705
  "CVE-2025-24983",
6189
6706
  "CVE-2025-24984",
6190
6707
  "CVE-2025-24985",
6708
+ "CVE-2025-24989",
6191
6709
  "CVE-2025-24991",
6192
6710
  "CVE-2025-24993",
6711
+ "CVE-2025-25181",
6193
6712
  "CVE-2025-25297",
6713
+ "CVE-2025-26633",
6194
6714
  "CVE-2025-27363",
6195
6715
  "CVE-2025-27520",
6196
6716
  "CVE-2025-2783",
@@ -6263,12 +6783,18 @@
6263
6783
  "CVE-2026-42271",
6264
6784
  "CVE-2026-45247",
6265
6785
  "CVE-2026-45498",
6786
+ "CVE-2026-45659",
6266
6787
  "CVE-2026-45829",
6267
6788
  "CVE-2026-46300",
6268
6789
  "CVE-2026-46333",
6269
6790
  "CVE-2026-48172",
6791
+ "CVE-2026-48282",
6792
+ "CVE-2026-48558",
6270
6793
  "CVE-2026-48907",
6794
+ "CVE-2026-48908",
6795
+ "CVE-2026-48939",
6271
6796
  "CVE-2026-54420",
6797
+ "CVE-2026-56291",
6272
6798
  "CVE-2026-5760",
6273
6799
  "CVE-2026-7473",
6274
6800
  "CVE-2026-8398",
@@ -6306,6 +6832,8 @@
6306
6832
  "status": "open",
6307
6833
  "opened_date": "2026-05-17",
6308
6834
  "evidence_cves": [
6835
+ "CVE-2020-29574",
6836
+ "CVE-2021-44207",
6309
6837
  "CVE-2022-0492",
6310
6838
  "CVE-2022-1471",
6311
6839
  "CVE-2022-36551",
@@ -6331,6 +6859,7 @@
6331
6859
  "CVE-2024-12776",
6332
6860
  "CVE-2024-13059",
6333
6861
  "CVE-2024-1561",
6862
+ "CVE-2024-20481",
6334
6863
  "CVE-2024-21182",
6335
6864
  "CVE-2024-21513",
6336
6865
  "CVE-2024-21575",
@@ -6339,28 +6868,34 @@
6339
6868
  "CVE-2024-24590",
6340
6869
  "CVE-2024-24591",
6341
6870
  "CVE-2024-27132",
6871
+ "CVE-2024-28987",
6342
6872
  "CVE-2024-2912",
6343
6873
  "CVE-2024-31462",
6344
6874
  "CVE-2024-37032",
6345
6875
  "CVE-2024-37052",
6346
6876
  "CVE-2024-37060",
6347
6877
  "CVE-2024-39722",
6878
+ "CVE-2024-41713",
6348
6879
  "CVE-2024-42478",
6349
6880
  "CVE-2024-42479",
6881
+ "CVE-2024-43093",
6350
6882
  "CVE-2024-4889",
6351
6883
  "CVE-2024-50050",
6352
6884
  "CVE-2024-5565",
6353
6885
  "CVE-2024-6047",
6354
6886
  "CVE-2024-6587",
6887
+ "CVE-2024-8963",
6355
6888
  "CVE-2024-9526",
6356
6889
  "CVE-2025-0282",
6357
6890
  "CVE-2025-10164",
6358
6891
  "CVE-2025-1550",
6359
6892
  "CVE-2025-1753",
6360
6893
  "CVE-2025-1796",
6894
+ "CVE-2025-21391",
6361
6895
  "CVE-2025-22457",
6362
6896
  "CVE-2025-23254",
6363
6897
  "CVE-2025-23266",
6898
+ "CVE-2025-24200",
6364
6899
  "CVE-2025-25297",
6365
6900
  "CVE-2025-27363",
6366
6901
  "CVE-2025-27520",
@@ -6431,6 +6966,7 @@
6431
6966
  "CVE-2026-46300",
6432
6967
  "CVE-2026-46333",
6433
6968
  "CVE-2026-48172",
6969
+ "CVE-2026-48908",
6434
6970
  "CVE-2026-50751",
6435
6971
  "CVE-2026-5760",
6436
6972
  "CVE-2026-7473",
@@ -6466,6 +7002,8 @@
6466
7002
  "status": "open",
6467
7003
  "opened_date": "2026-05-17",
6468
7004
  "evidence_cves": [
7005
+ "CVE-2024-9537",
7006
+ "CVE-2025-24200",
6469
7007
  "CVE-2025-34291",
6470
7008
  "CVE-2026-46300",
6471
7009
  "CVE-2026-46333"
@@ -6728,20 +7266,32 @@
6728
7266
  "status": "open",
6729
7267
  "opened_date": "2026-05-18",
6730
7268
  "evidence_cves": [
7269
+ "CVE-2018-19410",
6731
7270
  "CVE-2020-10148",
7271
+ "CVE-2021-44207",
6732
7272
  "CVE-2022-1471",
7273
+ "CVE-2022-23227",
6733
7274
  "CVE-2023-43654",
6734
7275
  "CVE-2023-48022",
6735
7276
  "CVE-2023-6016",
6736
7277
  "CVE-2023-6019",
6737
7278
  "CVE-2023-6021",
6738
7279
  "CVE-2023-6038",
7280
+ "CVE-2024-11680",
6739
7281
  "CVE-2024-12776",
6740
7282
  "CVE-2024-1709",
6741
7283
  "CVE-2024-21182",
7284
+ "CVE-2024-28987",
6742
7285
  "CVE-2024-2912",
7286
+ "CVE-2024-43451",
7287
+ "CVE-2024-47575",
6743
7288
  "CVE-2024-4889",
7289
+ "CVE-2024-53704",
7290
+ "CVE-2024-55591",
7291
+ "CVE-2024-5910",
6744
7292
  "CVE-2024-6587",
7293
+ "CVE-2024-7593",
7294
+ "CVE-2024-8956",
6745
7295
  "CVE-2025-1796",
6746
7296
  "CVE-2025-27520",
6747
7297
  "CVE-2025-3248",
@@ -6866,8 +7416,12 @@
6866
7416
  "status": "open",
6867
7417
  "opened_date": "2026-05-18",
6868
7418
  "evidence_cves": [
7419
+ "CVE-2014-2120",
7420
+ "CVE-2020-2883",
6869
7421
  "CVE-2021-20035",
7422
+ "CVE-2021-40407",
6870
7423
  "CVE-2022-36551",
7424
+ "CVE-2023-25280",
6871
7425
  "CVE-2023-44221",
6872
7426
  "CVE-2023-44487",
6873
7427
  "CVE-2023-50387",
@@ -6875,9 +7429,18 @@
6875
7429
  "CVE-2023-51764",
6876
7430
  "CVE-2023-51765",
6877
7431
  "CVE-2023-51766",
7432
+ "CVE-2024-11667",
7433
+ "CVE-2024-1212",
6878
7434
  "CVE-2024-12450",
7435
+ "CVE-2024-20481",
6879
7436
  "CVE-2024-21762",
7437
+ "CVE-2024-23113",
6880
7438
  "CVE-2024-31462",
7439
+ "CVE-2024-3393",
7440
+ "CVE-2024-38812",
7441
+ "CVE-2024-50603",
7442
+ "CVE-2024-9474",
7443
+ "CVE-2025-0108",
6881
7444
  "CVE-2025-0282",
6882
7445
  "CVE-2025-10164",
6883
7446
  "CVE-2025-1316",
@@ -6906,6 +7469,7 @@
6906
7469
  "CVE-2026-34909",
6907
7470
  "CVE-2026-34910",
6908
7471
  "CVE-2026-50751",
7472
+ "CVE-2026-56290",
6909
7473
  "CVE-2026-5760",
6910
7474
  "CVE-2026-7473"
6911
7475
  ],
@@ -7166,7 +7730,8 @@
7166
7730
  "status": "open",
7167
7731
  "opened_at": "2026-05-18",
7168
7732
  "evidence_cves": [
7169
- "CVE-2025-21085"
7733
+ "CVE-2025-21085",
7734
+ "CVE-2025-21391"
7170
7735
  ],
7171
7736
  "theater_test": {
7172
7737
  "claim": "We are compliant with AU-9 (Protection of Audit Information) because we follow the documented requirement: Protecting audit information and audit logging tools from unauthorized access, modification, and deletion. Anchored on the threat model that the adversary is trying to tamper with logs after the fact.",
@@ -7250,6 +7815,7 @@
7250
7815
  "status": "open",
7251
7816
  "opened_at": "2026-05-18",
7252
7817
  "evidence_cves": [
7818
+ "CVE-2024-9465",
7253
7819
  "CVE-2025-1094"
7254
7820
  ],
7255
7821
  "theater_test": {
@@ -7279,11 +7845,25 @@
7279
7845
  "opened_at": "2026-05-18",
7280
7846
  "evidence_cves": [
7281
7847
  "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
7848
+ "CVE-2018-19410",
7849
+ "CVE-2018-9276",
7850
+ "CVE-2019-11001",
7851
+ "CVE-2021-40407",
7852
+ "CVE-2021-41277",
7282
7853
  "CVE-2024-11120",
7854
+ "CVE-2024-29059",
7855
+ "CVE-2024-37383",
7856
+ "CVE-2024-41710",
7857
+ "CVE-2024-43093",
7858
+ "CVE-2024-45195",
7859
+ "CVE-2024-5910",
7283
7860
  "CVE-2024-6047",
7861
+ "CVE-2024-8957",
7862
+ "CVE-2025-0108",
7284
7863
  "CVE-2025-49844",
7285
7864
  "CVE-2025-59529",
7286
- "CVE-2025-8671"
7865
+ "CVE-2025-8671",
7866
+ "CVE-2026-48939"
7287
7867
  ],
7288
7868
  "theater_test": {
7289
7869
  "claim": "We are compliant with A.8.9 (Configuration management) because we follow the documented requirement: Annex A.8.9 — establishing, documenting, implementing, monitoring, and reviewing configurations of hardware, software, services, and networks. Anchored on a documented baseline and continuous monitori",
@@ -7399,7 +7979,11 @@
7399
7979
  "status": "open",
7400
7980
  "opened_at": "2026-05-18",
7401
7981
  "evidence_cves": [
7982
+ "CVE-2024-37383",
7983
+ "CVE-2024-43451",
7402
7984
  "CVE-2025-14847",
7985
+ "CVE-2025-23209",
7986
+ "CVE-2026-55255",
7403
7987
  "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER"
7404
7988
  ],
7405
7989
  "theater_test": {
@@ -7532,7 +8116,7 @@
7532
8116
  }
7533
8117
  },
7534
8118
  "ATLAS-AML.T0048": {
7535
- "framework": "MITRE ATLAS v2026.05",
8119
+ "framework": "MITRE ATLAS v2026.06",
7536
8120
  "control_id": "AML.T0048",
7537
8121
  "control_name": "External Harms — ML Supply Chain Compromise (bundled-codec / inference-server class)",
7538
8122
  "designed_for": "ATLAS AML.T0048 catalogues external harms from ML supply-chain compromise, including malicious model weights, poisoned training data, and compromised ML libraries. The technique-level guidance covers detection and mitigation at the model-artifact and library-consumption layer.",
@@ -7808,6 +8392,8 @@
7808
8392
  "status": "open",
7809
8393
  "opened_at": "2026-05-18",
7810
8394
  "evidence_cves": [
8395
+ "CVE-2024-40711",
8396
+ "CVE-2024-50623",
7811
8397
  "CVE-2025-22225"
7812
8398
  ],
7813
8399
  "theater_test": {
@@ -8366,17 +8952,34 @@
8366
8952
  "status": "open",
8367
8953
  "opened_date": "2026-05-18",
8368
8954
  "evidence_cves": [
8955
+ "CVE-2019-16278",
8369
8956
  "CVE-2019-6693",
8370
8957
  "CVE-2020-17103-REREGRESSION-2026",
8371
8958
  "CVE-2022-0492",
8372
8959
  "CVE-2023-21529",
8373
8960
  "CVE-2023-27351",
8961
+ "CVE-2023-48365",
8962
+ "CVE-2024-12356",
8374
8963
  "CVE-2024-1708",
8375
8964
  "CVE-2024-21182",
8376
8965
  "CVE-2024-27199",
8966
+ "CVE-2024-37383",
8967
+ "CVE-2024-45195",
8968
+ "CVE-2024-45519",
8969
+ "CVE-2024-47575",
8970
+ "CVE-2024-50623",
8971
+ "CVE-2024-51378",
8972
+ "CVE-2024-53704",
8377
8973
  "CVE-2024-57726",
8378
8974
  "CVE-2024-57728",
8975
+ "CVE-2024-5910",
8976
+ "CVE-2024-8963",
8977
+ "CVE-2024-9463",
8978
+ "CVE-2024-9465",
8979
+ "CVE-2024-9680",
8980
+ "CVE-2025-0994",
8379
8981
  "CVE-2025-10035",
8982
+ "CVE-2025-24200",
8380
8983
  "CVE-2025-27363",
8381
8984
  "CVE-2025-30400",
8382
8985
  "CVE-2025-48595",
@@ -8393,7 +8996,8 @@
8393
8996
  "CVE-2026-20131",
8394
8997
  "CVE-2026-23760",
8395
8998
  "CVE-2026-24423",
8396
- "CVE-2026-41940"
8999
+ "CVE-2026-41940",
9000
+ "CVE-2026-48939"
8397
9001
  ],
8398
9002
  "theater_test": {
8399
9003
  "claim": "Vulnerability handling and disclosure procedures align with NIS2 Art.21 obligations.",
@@ -8419,7 +9023,10 @@
8419
9023
  "status": "open",
8420
9024
  "opened_date": "2026-05-18",
8421
9025
  "evidence_cves": [
8422
- "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND"
9026
+ "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
9027
+ "CVE-2024-20481",
9028
+ "CVE-2024-3393",
9029
+ "CVE-2024-49039"
8423
9030
  ],
8424
9031
  "theater_test": {
8425
9032
  "claim": "System monitoring effectively detects compromise and security-control degradation per NIST 800-53 SI-4.",