@blamejs/exceptd-skills 0.18.21 → 0.18.22

package/ARCHITECTURE.md

@@ -176,7 +176,7 @@ Tracks PoC status, weaponization stage, and AI-assist factor per CVE. Updated wh
 
 ### `data/cwe-catalog.json`
 
-193 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
+199 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
 
 `_meta.cwe_version` pins the version; on a CWE release, audit IDs for renames or deprecations, bump `last_threat_review` on affected skills, and update `_meta`.
 

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.18.22 — 2026-07-11
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (519 → 619), covering the most recent additions to the CISA Known Exploited Vulnerabilities catalog (September 2024 through July 2026). Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch spans internet-facing edge and enterprise infrastructure — Palo Alto PAN-OS management auth bypass (CVE-2025-0108), SonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704), Fortinet FortiManager "FortiJump" (CVE-2024-47575) and the FortiOS fgfmd format-string RCE (CVE-2024-23113), SimpleHelp path traversal on RMM servers (CVE-2024-57727), an Ivanti Cloud Services Appliance path-traversal chain (CVE-2024-8963), Veeam Backup & Replication deserialization RCE (CVE-2024-40711), Trimble Cityworks deserialization (CVE-2025-0994), and Microsoft SharePoint code injection (CVE-2024-38094) — alongside client and mobile exploitation such as the Apple iOS USB Restricted Mode bypass used in targeted attacks (CVE-2025-24200), a Firefox animation-timeline use-after-free deployed by RomCom (CVE-2024-9680), the Windows NTLM hash-disclosure flaw (CVE-2024-43451), and an Android Framework privilege escalation (CVE-2024-43093). Two of the hundred were AI-assisted discoveries, including the PTZOptics camera command-injection pair surfaced by an LLM triaging honeypot traffic (CVE-2024-8956, CVE-2024-8957); the Langflow server-side code execution flaw is also included (CVE-2026-55255). Six weakness classes backing these entries are new to the CWE catalog: CWE-114, CWE-134, CWE-176, CWE-273, CWE-303, and CWE-425.
+
+Batch curation tooling: the new `exceptd refresh --curate-batch` command promotes a set of KEV drafts into fully-curated catalog entries from a facts file and a per-CVE judgment file in one pass, refusing to write any entry whose CWE, ATT&CK, or framework-control references are not already present in their catalogs. The nightly data refresh now pre-enriches newly-KEV-listed CVEs with NVD (CVSS, CWE) and FIRST EPSS data at import time and raises the per-run discovery cap from twenty to one hundred, so auto-imported drafts arrive with their mechanical fields already populated; `vendor_advisories` now reflects only real vendor advisories rather than a placeholder, so the catalog-gap detector correctly surfaces entries still missing one.
+
 ## 0.18.21 — 2026-07-03
 
 CVE catalog currency: twenty more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (519 total), each carrying a verified NVD CVSS vector and CWE, an ATT&CK technique mapping, behavioral indicators, global-first framework-control-gap declarations, an RWEP score, and a paired zero-day lesson. The additions cover Microsoft SharePoint Server deserialization (CVE-2026-45659) and the Windows MSC "EvilTwin" console-file bypass exploited by EncryptHub/Water Gamayun (CVE-2025-26633); the SimpleHelp OIDC signature-verification bypass on internet-facing RMM servers (CVE-2026-48558); the three Ivanti Endpoint Manager credential-coercion path traversals (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161); the Advantive VeraCore upload and SQL-injection pair used by XE Group (CVE-2024-57968, CVE-2025-25181); a Linux kernel HID information leak used in a Cellebrite Android-unlock chain (CVE-2024-50302); Progress WhatsUp Gold path-traversal RCE (CVE-2024-4885); a Windows Win32k local privilege escalation (CVE-2018-8639); the Hitachi Vantara Pentaho BA Server authorization-bypass-plus-injection chain (CVE-2022-43769, CVE-2022-43939); the end-of-life Cisco Small Business RV command injection abused by the PolarEdge botnet (CVE-2023-20118); Zimbra Collaboration Suite stored XSS (CVE-2023-34192); Microsoft Partner Center (CVE-2024-49035) and Power Pages (CVE-2025-24989) access-control flaws; Oracle Agile PLM (CVE-2024-20953) and Adobe ColdFusion BlazeDS (CVE-2017-3066) deserialization RCE; and the Palo Alto PAN-OS authenticated arbitrary file read that attackers chain with the CVE-2025-0108 auth bypass (CVE-2025-0111). Four weakness classes backing these entries are new to the CWE catalog: CWE-707, CWE-404, CWE-647, and CWE-610.

package/bin/exceptd.js

@@ -718,10 +718,13 @@ function main() {
     // data slice without requiring a full package upgrade.
     effectiveCmd = "refresh-network";
     effectiveRest = rest.filter(a => a !== "--network");
-  } else if (cmd === "refresh" && rest.includes("--curate")) {
+  } else if (cmd === "refresh" && (rest.includes("--curate") || rest.includes("--curate-batch"))) {
     // v0.12.0: --curate <CVE-ID> emits editorial questions + ranked
     // candidates (atlas/attack/cwe/framework) for a draft catalog entry.
     // Operator or AI assistant fills the null editorial fields.
+    // --curate-batch <facts+judgments files> assembles + writes many
+    // gate-passing entries in one shot; cve-curation.js's cli() branches
+    // to lib/cve-batch.js when it sees the flag.
     effectiveCmd = "refresh-curate";
     effectiveRest = rest;
   }

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-03T23:38:50.552Z",
+  "generated_at": "2026-07-11T23:54:45.339Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "b347a576339f0abe2d01349f956e205872eba35dbc508cd4e8746d21313b5a45",
+    "manifest.json": "640ae4a66f3db19b0cb14761f45be4de1d432d0728f402cff45c1a4cb62807a7",
     "README.md": "91d223cb15dacbeb16642b2f4e0afcd41e086d33a10006a6d3b686f76ae32539",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "2673046f2180b548157b6e57e6b75648e03f094d83a442704c449a4822e4bf17",
-    "data/cve-catalog.json": "4e7bdca6cf824de60ef014f6f73352655f28bd68c9f04a8bf59e3c813bd0f464",
-    "data/cwe-catalog.json": "588c3f76992b196ba4f8673f308ffa355209153a8e8599eec7735115ebeb88a8",
+    "data/attack-techniques.json": "8bfd00768b038f17601ad8cab9d4efee4bb5dd9319dc9924c6724be2fa37864c",
+    "data/cve-catalog.json": "59e9b78bcc2f36e76ff9fad7fd3ca20feae799da8ff889e202db312c1c7b330b",
+    "data/cwe-catalog.json": "0fe9c3d27daddaf1edf287ee7b8cbbdc004ab656e54abed41f8ddbe739df29eb",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "72fa93815f5c26c8289e63eadcff40509f86b41b86038bff919470ae7082c0f4",
+    "data/framework-control-gaps.json": "832547285529fdeb8110d39d471120cfee3053a8b2de3de1a9350715ef518732",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "209fc9ce17db5341e189e447160bf207b545edb9f7ef585a90024e7f067f2aa4",
+    "data/zeroday-lessons.json": "96556be0a5fe8f4f72fb3924cc7caf6d8f801cbeb12b85816cf8b0e1af7e81e6",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 506,
-    "chains_cwe_entries": 193,
+    "chains_cve_entries": 606,
+    "chains_cwe_entries": 199,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -19,7 +19,7 @@
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 193
+      "entry_count": 199
     },
     {
       "date": "2026-07-03",
@@ -27,7 +27,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 519
+      "entry_count": 619
     },
     {
       "date": "2026-06-10",
@@ -330,7 +330,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 519
+      "entry_count": 619
     },
     {
       "date": "2026-05-27",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 519,
+      "entry_count": 619,
       "sample_keys": [
-        "CVE-2026-45659",
-        "CVE-2026-48558",
-        "CVE-2025-26633",
-        "CVE-2024-13161",
-        "CVE-2024-13160"
+        "CVE-2026-56291",
+        "CVE-2026-48939",
+        "CVE-2026-56290",
+        "CVE-2026-55255",
+        "CVE-2026-48908"
       ]
     },
     "cwe-catalog.json": {
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 193,
+      "entry_count": 199,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 519,
+      "entry_count": 619,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",