@blamejs/exceptd-skills 0.18.21 → 0.18.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/ARCHITECTURE.md +1 -1
  2. package/CHANGELOG.md +6 -0
  3. package/bin/exceptd.js +4 -1
  4. package/data/_indexes/_meta.json +9 -9
  5. package/data/_indexes/activity-feed.json +3 -3
  6. package/data/_indexes/catalog-summaries.json +8 -8
  7. package/data/_indexes/chains.json +56413 -604
  8. package/data/_indexes/frequency.json +6 -0
  9. package/data/attack-techniques.json +244 -6
  10. package/data/cve-catalog.json +9315 -1
  11. package/data/cwe-catalog.json +273 -7
  12. package/data/framework-control-gaps.json +519 -12
  13. package/data/zeroday-lessons.json +3916 -1
  14. package/lib/auto-discovery.js +54 -67
  15. package/lib/cve-batch.js +216 -0
  16. package/lib/cve-curation.js +4 -0
  17. package/lib/cve-enrich.js +172 -0
  18. package/lib/prefetch.js +189 -110
  19. package/lib/scoring.js +24 -0
  20. package/manifest.json +53 -53
  21. package/package.json +2 -2
  22. package/sbom.cdx.json +65 -35
package/data/framework-control-gaps.json CHANGED
@@ -239,7 +239,23 @@
239
239
  "real_requirement": "User-application hardening enumerates AI assistants and MCP servers in scope; sets default-deny on tool grants with explicit per-tool acknowledgement; pins MCP server versions with signature verification; treats AI-tool config files (.claude/settings.json, .cursor/mcp.json, .vscode/settings.json's chat.tools.autoApprove) as integrity-monitored configuration with the same protection profile as security-sensitive files.",
240
240
  "status": "open",
241
241
  "opened_date": "2026-05-13",
242
- "evidence_cves": [],
242
+ "evidence_cves": [
243
+ "CVE-2018-9276",
244
+ "CVE-2019-16278",
245
+ "CVE-2022-23748",
246
+ "CVE-2024-29059",
247
+ "CVE-2024-41710",
248
+ "CVE-2024-43572",
249
+ "CVE-2024-43573",
250
+ "CVE-2024-44308",
251
+ "CVE-2024-49039",
252
+ "CVE-2024-55956",
253
+ "CVE-2024-8957",
254
+ "CVE-2024-9463",
255
+ "CVE-2024-9680",
256
+ "CVE-2025-0411",
257
+ "CVE-2026-48939"
258
+ ],
243
259
  "atlas_refs": [
244
260
  "AML.T0010",
245
261
  "AML.T0051"
@@ -341,36 +357,98 @@
341
357
  "status": "open",
342
358
  "opened_date": "2026-05-13",
343
359
  "evidence_cves": [
360
+ "CVE-2014-2120",
344
361
  "CVE-2017-12637",
345
362
  "CVE-2017-3066",
363
+ "CVE-2018-14933",
364
+ "CVE-2018-19410",
346
365
  "CVE-2018-8639",
366
+ "CVE-2019-11001",
347
367
  "CVE-2019-9874",
348
368
  "CVE-2019-9875",
369
+ "CVE-2020-11023",
370
+ "CVE-2020-15069",
371
+ "CVE-2020-15415",
372
+ "CVE-2020-2883",
349
373
  "CVE-2021-20035",
374
+ "CVE-2021-26086",
375
+ "CVE-2021-40407",
376
+ "CVE-2021-41277",
377
+ "CVE-2022-23227",
350
378
  "CVE-2022-43769",
351
379
  "CVE-2022-43939",
352
380
  "CVE-2023-20118",
381
+ "CVE-2023-25280",
382
+ "CVE-2023-28461",
353
383
  "CVE-2023-34192",
354
384
  "CVE-2023-44221",
385
+ "CVE-2023-45727",
386
+ "CVE-2023-48365",
387
+ "CVE-2024-11667",
388
+ "CVE-2024-11680",
389
+ "CVE-2024-1212",
390
+ "CVE-2024-12356",
391
+ "CVE-2024-12686",
355
392
  "CVE-2024-13159",
356
393
  "CVE-2024-13160",
357
394
  "CVE-2024-13161",
358
395
  "CVE-2024-20439",
396
+ "CVE-2024-20767",
359
397
  "CVE-2024-20953",
398
+ "CVE-2024-21413",
399
+ "CVE-2024-23113",
400
+ "CVE-2024-29824",
401
+ "CVE-2024-30088",
402
+ "CVE-2024-3393",
403
+ "CVE-2024-35250",
360
404
  "CVE-2024-38475",
405
+ "CVE-2024-38812",
406
+ "CVE-2024-38813",
407
+ "CVE-2024-40711",
408
+ "CVE-2024-40890",
409
+ "CVE-2024-40891",
410
+ "CVE-2024-43047",
411
+ "CVE-2024-44309",
412
+ "CVE-2024-45195",
413
+ "CVE-2024-45519",
414
+ "CVE-2024-47575",
361
415
  "CVE-2024-48248",
362
416
  "CVE-2024-4885",
363
417
  "CVE-2024-49035",
418
+ "CVE-2024-49138",
364
419
  "CVE-2024-50302",
420
+ "CVE-2024-50603",
421
+ "CVE-2024-51378",
422
+ "CVE-2024-51567",
423
+ "CVE-2024-53104",
365
424
  "CVE-2024-53150",
366
425
  "CVE-2024-53197",
426
+ "CVE-2024-53704",
427
+ "CVE-2024-55550",
428
+ "CVE-2024-55591",
429
+ "CVE-2024-57727",
367
430
  "CVE-2024-57968",
368
431
  "CVE-2024-58136",
432
+ "CVE-2024-5910",
433
+ "CVE-2024-7593",
434
+ "CVE-2024-8956",
435
+ "CVE-2024-9379",
436
+ "CVE-2024-9380",
437
+ "CVE-2024-9474",
438
+ "CVE-2025-0108",
369
439
  "CVE-2025-0111",
440
+ "CVE-2025-0994",
370
441
  "CVE-2025-1316",
371
442
  "CVE-2025-1976",
443
+ "CVE-2025-21333",
444
+ "CVE-2025-21334",
445
+ "CVE-2025-21335",
446
+ "CVE-2025-21418",
372
447
  "CVE-2025-21590",
448
+ "CVE-2025-23006",
449
+ "CVE-2025-23209",
373
450
  "CVE-2025-24054",
451
+ "CVE-2025-24085",
374
452
  "CVE-2025-24472",
375
453
  "CVE-2025-24813",
376
454
  "CVE-2025-24983",
@@ -400,7 +478,9 @@
400
478
  "CVE-2026-45659",
401
479
  "CVE-2026-48558",
402
480
  "CVE-2026-48907",
403
- "CVE-2026-54420"
481
+ "CVE-2026-54420",
482
+ "CVE-2026-56290",
483
+ "CVE-2026-56291"
404
484
  ],
405
485
  "atlas_refs": [],
406
486
  "attack_refs": [
@@ -1498,6 +1578,7 @@
1498
1578
  "CVE-2012-1854",
1499
1579
  "CVE-2013-3893",
1500
1580
  "CVE-2013-3918",
1581
+ "CVE-2014-2120",
1501
1582
  "CVE-2014-3931",
1502
1583
  "CVE-2014-6278",
1503
1584
  "CVE-2015-7755",
@@ -1508,14 +1589,19 @@
1508
1589
  "CVE-2017-3066",
1509
1590
  "CVE-2017-7921",
1510
1591
  "CVE-2018-14634",
1592
+ "CVE-2018-14933",
1511
1593
  "CVE-2018-4063",
1512
1594
  "CVE-2018-8639",
1595
+ "CVE-2019-0344",
1596
+ "CVE-2019-16278",
1513
1597
  "CVE-2019-19006",
1514
1598
  "CVE-2019-5418",
1515
1599
  "CVE-2019-6693",
1516
1600
  "CVE-2019-9621",
1517
1601
  "CVE-2019-9874",
1518
1602
  "CVE-2019-9875",
1603
+ "CVE-2020-11023",
1604
+ "CVE-2020-15069",
1519
1605
  "CVE-2020-17103-REREGRESSION-2026",
1520
1606
  "CVE-2020-24363",
1521
1607
  "CVE-2020-25078",
@@ -1528,6 +1614,7 @@
1528
1614
  "CVE-2021-22175",
1529
1615
  "CVE-2021-22555",
1530
1616
  "CVE-2021-22681",
1617
+ "CVE-2021-26086",
1531
1618
  "CVE-2021-26828",
1532
1619
  "CVE-2021-26829",
1533
1620
  "CVE-2021-30952",
@@ -1539,6 +1626,8 @@
1539
1626
  "CVE-2021-43798",
1540
1627
  "CVE-2022-1471",
1541
1628
  "CVE-2022-20775",
1629
+ "CVE-2022-23227",
1630
+ "CVE-2022-23748",
1542
1631
  "CVE-2022-37055",
1543
1632
  "CVE-2022-40799",
1544
1633
  "CVE-2022-43769",
@@ -1549,6 +1638,7 @@
1549
1638
  "CVE-2023-21529",
1550
1639
  "CVE-2023-2533",
1551
1640
  "CVE-2023-27351",
1641
+ "CVE-2023-28461",
1552
1642
  "CVE-2023-33538",
1553
1643
  "CVE-2023-34192",
1554
1644
  "CVE-2023-36424",
@@ -1560,6 +1650,7 @@
1560
1650
  "CVE-2023-44221",
1561
1651
  "CVE-2023-44467",
1562
1652
  "CVE-2023-44487",
1653
+ "CVE-2023-48365",
1563
1654
  "CVE-2023-50224",
1564
1655
  "CVE-2023-50387",
1565
1656
  "CVE-2023-50868",
@@ -1586,6 +1677,7 @@
1586
1677
  "CVE-2024-1708",
1587
1678
  "CVE-2024-20439",
1588
1679
  "CVE-2024-20953",
1680
+ "CVE-2024-21287",
1589
1681
  "CVE-2024-21513",
1590
1682
  "CVE-2024-21575",
1591
1683
  "CVE-2024-21576",
@@ -1593,34 +1685,44 @@
1593
1685
  "CVE-2024-27132",
1594
1686
  "CVE-2024-27199",
1595
1687
  "CVE-2024-27443",
1688
+ "CVE-2024-35250",
1596
1689
  "CVE-2024-37032",
1597
1690
  "CVE-2024-37079",
1691
+ "CVE-2024-38094",
1598
1692
  "CVE-2024-38475",
1599
1693
  "CVE-2024-39722",
1600
1694
  "CVE-2024-42009",
1601
1695
  "CVE-2024-42478",
1602
1696
  "CVE-2024-42479",
1603
1697
  "CVE-2024-43468",
1698
+ "CVE-2024-44309",
1604
1699
  "CVE-2024-48248",
1605
1700
  "CVE-2024-4885",
1606
1701
  "CVE-2024-4889",
1607
1702
  "CVE-2024-49035",
1608
1703
  "CVE-2024-50050",
1609
1704
  "CVE-2024-50302",
1705
+ "CVE-2024-51567",
1610
1706
  "CVE-2024-53150",
1611
1707
  "CVE-2024-53197",
1708
+ "CVE-2024-53704",
1612
1709
  "CVE-2024-54085",
1613
1710
  "CVE-2024-56145",
1614
1711
  "CVE-2024-57726",
1712
+ "CVE-2024-57727",
1615
1713
  "CVE-2024-57728",
1616
1714
  "CVE-2024-57968",
1617
1715
  "CVE-2024-58136",
1618
1716
  "CVE-2024-6047",
1619
1717
  "CVE-2024-6587",
1620
1718
  "CVE-2024-7399",
1719
+ "CVE-2024-7593",
1621
1720
  "CVE-2024-7694",
1622
1721
  "CVE-2024-8068",
1623
1722
  "CVE-2024-8069",
1723
+ "CVE-2024-8963",
1724
+ "CVE-2024-9463",
1725
+ "CVE-2024-9465",
1624
1726
  "CVE-2025-0111",
1625
1727
  "CVE-2025-0282",
1626
1728
  "CVE-2025-10035",
@@ -1645,6 +1747,8 @@
1645
1747
  "CVE-2025-20393",
1646
1748
  "CVE-2025-21042",
1647
1749
  "CVE-2025-21043",
1750
+ "CVE-2025-21391",
1751
+ "CVE-2025-21418",
1648
1752
  "CVE-2025-21479",
1649
1753
  "CVE-2025-21480",
1650
1754
  "CVE-2025-21590",
@@ -1652,6 +1756,7 @@
1652
1756
  "CVE-2025-23254",
1653
1757
  "CVE-2025-24016",
1654
1758
  "CVE-2025-24054",
1759
+ "CVE-2025-24085",
1655
1760
  "CVE-2025-24201",
1656
1761
  "CVE-2025-24472",
1657
1762
  "CVE-2025-24813",
@@ -1882,11 +1987,14 @@
1882
1987
  "CVE-2026-46333",
1883
1988
  "CVE-2026-48027",
1884
1989
  "CVE-2026-48172",
1990
+ "CVE-2026-48282",
1885
1991
  "CVE-2026-48558",
1886
1992
  "CVE-2026-48907",
1993
+ "CVE-2026-48908",
1887
1994
  "CVE-2026-50751",
1888
1995
  "CVE-2026-5281",
1889
1996
  "CVE-2026-54420",
1997
+ "CVE-2026-56291",
1890
1998
  "CVE-2026-9082"
1891
1999
  ],
1892
2000
  "atlas_refs": [],
@@ -2030,6 +2138,13 @@
2030
2138
  "status": "open",
2031
2139
  "opened_date": "2026-05-13",
2032
2140
  "evidence_cves": [
2141
+ "CVE-2024-38094",
2142
+ "CVE-2024-43451",
2143
+ "CVE-2024-49039",
2144
+ "CVE-2024-51567",
2145
+ "CVE-2024-55591",
2146
+ "CVE-2024-55956",
2147
+ "CVE-2025-21391",
2033
2148
  "CVE-2026-39987",
2034
2149
  "CVE-2026-42208",
2035
2150
  "CVE-2026-42897"
@@ -2068,6 +2183,8 @@
2068
2183
  "status": "open",
2069
2184
  "opened_date": "2026-03-15",
2070
2185
  "evidence_cves": [
2186
+ "CVE-2020-15415",
2187
+ "CVE-2021-41277",
2071
2188
  "CVE-2022-1471",
2072
2189
  "CVE-2023-43654",
2073
2190
  "CVE-2023-44467",
@@ -2082,15 +2199,20 @@
2082
2199
  "CVE-2024-11394",
2083
2200
  "CVE-2024-13059",
2084
2201
  "CVE-2024-1561",
2202
+ "CVE-2024-21413",
2085
2203
  "CVE-2024-21513",
2086
2204
  "CVE-2024-21575",
2087
2205
  "CVE-2024-21576",
2088
2206
  "CVE-2024-27132",
2207
+ "CVE-2024-30088",
2208
+ "CVE-2024-35250",
2089
2209
  "CVE-2024-37032",
2090
2210
  "CVE-2024-39722",
2211
+ "CVE-2024-40711",
2091
2212
  "CVE-2024-42478",
2092
2213
  "CVE-2024-42479",
2093
2214
  "CVE-2024-4889",
2215
+ "CVE-2024-49138",
2094
2216
  "CVE-2024-50050",
2095
2217
  "CVE-2024-6587",
2096
2218
  "CVE-2025-10585",
@@ -2297,6 +2419,7 @@
2297
2419
  "status": "open",
2298
2420
  "opened_date": "2026-03-01",
2299
2421
  "evidence_cves": [
2422
+ "CVE-2024-28987",
2300
2423
  "CVE-2025-53773"
2301
2424
  ],
2302
2425
  "atlas_refs": [
@@ -2333,13 +2456,28 @@
2333
2456
  "opened_date": "2026-04-01",
2334
2457
  "evidence_cves": [
2335
2458
  "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
2459
+ "CVE-2018-14933",
2460
+ "CVE-2019-16278",
2461
+ "CVE-2022-23227",
2462
+ "CVE-2022-23748",
2463
+ "CVE-2023-25280",
2336
2464
  "CVE-2023-6016",
2337
2465
  "CVE-2024-12366",
2338
2466
  "CVE-2024-24590",
2339
2467
  "CVE-2024-24591",
2468
+ "CVE-2024-29059",
2340
2469
  "CVE-2024-2912",
2341
2470
  "CVE-2024-3154",
2471
+ "CVE-2024-40891",
2472
+ "CVE-2024-43093",
2473
+ "CVE-2024-43572",
2474
+ "CVE-2024-44308",
2475
+ "CVE-2024-53104",
2342
2476
  "CVE-2024-5565",
2477
+ "CVE-2024-55956",
2478
+ "CVE-2024-9537",
2479
+ "CVE-2025-0411",
2480
+ "CVE-2025-24085",
2343
2481
  "CVE-2025-27520",
2344
2482
  "CVE-2025-3248",
2345
2483
  "CVE-2025-3466",
@@ -2355,6 +2493,7 @@
2355
2493
  "CVE-2026-42271",
2356
2494
  "CVE-2026-45247",
2357
2495
  "CVE-2026-48172",
2496
+ "CVE-2026-56290",
2358
2497
  "CVE-2026-8398"
2359
2498
  ],
2360
2499
  "atlas_refs": [
@@ -2500,25 +2639,52 @@
2500
2639
  "status": "open",
2501
2640
  "opened_date": "2026-05-01",
2502
2641
  "evidence_cves": [
2642
+ "CVE-2019-0344",
2643
+ "CVE-2020-15069",
2644
+ "CVE-2020-15415",
2645
+ "CVE-2020-2883",
2503
2646
  "CVE-2021-20035",
2504
2647
  "CVE-2022-36551",
2505
2648
  "CVE-2023-44221",
2649
+ "CVE-2023-45727",
2506
2650
  "CVE-2023-48022",
2507
2651
  "CVE-2023-51449",
2508
2652
  "CVE-2023-6038",
2653
+ "CVE-2024-0012",
2509
2654
  "CVE-2024-0132",
2510
2655
  "CVE-2024-11120",
2656
+ "CVE-2024-11667",
2657
+ "CVE-2024-1212",
2658
+ "CVE-2024-12356",
2511
2659
  "CVE-2024-12450",
2512
2660
  "CVE-2024-1561",
2661
+ "CVE-2024-20481",
2662
+ "CVE-2024-20767",
2513
2663
  "CVE-2024-21182",
2664
+ "CVE-2024-21413",
2514
2665
  "CVE-2024-21575",
2515
2666
  "CVE-2024-21576",
2667
+ "CVE-2024-23113",
2668
+ "CVE-2024-38812",
2516
2669
  "CVE-2024-40635",
2670
+ "CVE-2024-40890",
2671
+ "CVE-2024-41713",
2517
2672
  "CVE-2024-42478",
2518
2673
  "CVE-2024-42479",
2674
+ "CVE-2024-43451",
2675
+ "CVE-2024-45519",
2676
+ "CVE-2024-50603",
2677
+ "CVE-2024-50623",
2678
+ "CVE-2024-55591",
2519
2679
  "CVE-2024-6047",
2680
+ "CVE-2024-8956",
2681
+ "CVE-2024-8963",
2682
+ "CVE-2024-9474",
2683
+ "CVE-2024-9680",
2684
+ "CVE-2025-0108",
2520
2685
  "CVE-2025-1976",
2521
2686
  "CVE-2025-21590",
2687
+ "CVE-2025-23006",
2522
2688
  "CVE-2025-23266",
2523
2689
  "CVE-2025-24472",
2524
2690
  "CVE-2025-25297",
@@ -2538,6 +2704,7 @@
2538
2704
  "CVE-2026-34909",
2539
2705
  "CVE-2026-34910",
2540
2706
  "CVE-2026-42897",
2707
+ "CVE-2026-48282",
2541
2708
  "CVE-2026-50751",
2542
2709
  "CVE-2026-5760",
2543
2710
  "CVE-2026-7473"
@@ -2758,6 +2925,7 @@
2758
2925
  "CVE-2012-1854",
2759
2926
  "CVE-2013-3893",
2760
2927
  "CVE-2013-3918",
2928
+ "CVE-2014-2120",
2761
2929
  "CVE-2014-3931",
2762
2930
  "CVE-2014-6278",
2763
2931
  "CVE-2015-7755",
@@ -2768,18 +2936,25 @@
2768
2936
  "CVE-2017-3066",
2769
2937
  "CVE-2017-7921",
2770
2938
  "CVE-2018-14634",
2939
+ "CVE-2018-14933",
2771
2940
  "CVE-2018-4063",
2772
2941
  "CVE-2018-8639",
2942
+ "CVE-2019-0344",
2943
+ "CVE-2019-11001",
2773
2944
  "CVE-2019-19006",
2774
2945
  "CVE-2019-5418",
2775
2946
  "CVE-2019-6693",
2776
2947
  "CVE-2019-9621",
2777
2948
  "CVE-2019-9874",
2778
2949
  "CVE-2019-9875",
2950
+ "CVE-2020-11023",
2951
+ "CVE-2020-15415",
2779
2952
  "CVE-2020-17103-REREGRESSION-2026",
2780
2953
  "CVE-2020-24363",
2781
2954
  "CVE-2020-25078",
2782
2955
  "CVE-2020-25079",
2956
+ "CVE-2020-2883",
2957
+ "CVE-2020-29574",
2783
2958
  "CVE-2020-7796",
2784
2959
  "CVE-2020-9715",
2785
2960
  "CVE-2021-20035",
@@ -2788,6 +2963,7 @@
2788
2963
  "CVE-2021-22175",
2789
2964
  "CVE-2021-22555",
2790
2965
  "CVE-2021-22681",
2966
+ "CVE-2021-26086",
2791
2967
  "CVE-2021-26828",
2792
2968
  "CVE-2021-26829",
2793
2969
  "CVE-2021-30952",
@@ -2795,11 +2971,15 @@
2795
2971
  "CVE-2021-33515",
2796
2972
  "CVE-2021-38371",
2797
2973
  "CVE-2021-39935",
2974
+ "CVE-2021-40407",
2975
+ "CVE-2021-41277",
2798
2976
  "CVE-2021-43226",
2799
2977
  "CVE-2021-43798",
2978
+ "CVE-2021-44207",
2800
2979
  "CVE-2022-0492",
2801
2980
  "CVE-2022-1471",
2802
2981
  "CVE-2022-20775",
2982
+ "CVE-2022-23748",
2803
2983
  "CVE-2022-37055",
2804
2984
  "CVE-2022-40799",
2805
2985
  "CVE-2022-43769",
@@ -2808,8 +2988,10 @@
2808
2988
  "CVE-2023-0386",
2809
2989
  "CVE-2023-20118",
2810
2990
  "CVE-2023-21529",
2991
+ "CVE-2023-25280",
2811
2992
  "CVE-2023-2533",
2812
2993
  "CVE-2023-27351",
2994
+ "CVE-2023-28461",
2813
2995
  "CVE-2023-33538",
2814
2996
  "CVE-2023-34192",
2815
2997
  "CVE-2023-3519",
@@ -2822,6 +3004,8 @@
2822
3004
  "CVE-2023-44221",
2823
3005
  "CVE-2023-44467",
2824
3006
  "CVE-2023-44487",
3007
+ "CVE-2023-45727",
3008
+ "CVE-2023-48365",
2825
3009
  "CVE-2023-50224",
2826
3010
  "CVE-2023-50387",
2827
3011
  "CVE-2023-50868",
@@ -2840,6 +3024,10 @@
2840
3024
  "CVE-2024-11392",
2841
3025
  "CVE-2024-11393",
2842
3026
  "CVE-2024-11394",
3027
+ "CVE-2024-11667",
3028
+ "CVE-2024-1212",
3029
+ "CVE-2024-12356",
3030
+ "CVE-2024-12686",
2843
3031
  "CVE-2024-12987",
2844
3032
  "CVE-2024-13059",
2845
3033
  "CVE-2024-13159",
@@ -2848,34 +3036,62 @@
2848
3036
  "CVE-2024-1561",
2849
3037
  "CVE-2024-1708",
2850
3038
  "CVE-2024-20439",
3039
+ "CVE-2024-20767",
2851
3040
  "CVE-2024-20953",
2852
3041
  "CVE-2024-21182",
3042
+ "CVE-2024-21287",
3043
+ "CVE-2024-21413",
2853
3044
  "CVE-2024-21513",
2854
3045
  "CVE-2024-21575",
2855
3046
  "CVE-2024-21576",
2856
3047
  "CVE-2024-21762",
3048
+ "CVE-2024-23113",
2857
3049
  "CVE-2024-27132",
2858
3050
  "CVE-2024-27199",
2859
3051
  "CVE-2024-27443",
3052
+ "CVE-2024-29824",
3053
+ "CVE-2024-30088",
3054
+ "CVE-2024-3393",
3055
+ "CVE-2024-35250",
2860
3056
  "CVE-2024-37032",
2861
3057
  "CVE-2024-37052",
2862
3058
  "CVE-2024-37060",
2863
3059
  "CVE-2024-37079",
3060
+ "CVE-2024-38094",
2864
3061
  "CVE-2024-38475",
3062
+ "CVE-2024-38812",
3063
+ "CVE-2024-38813",
2865
3064
  "CVE-2024-39722",
3065
+ "CVE-2024-40711",
3066
+ "CVE-2024-40890",
3067
+ "CVE-2024-40891",
3068
+ "CVE-2024-41713",
2866
3069
  "CVE-2024-42009",
2867
3070
  "CVE-2024-42478",
2868
3071
  "CVE-2024-42479",
3072
+ "CVE-2024-43047",
2869
3073
  "CVE-2024-43468",
3074
+ "CVE-2024-43572",
3075
+ "CVE-2024-43573",
3076
+ "CVE-2024-44308",
3077
+ "CVE-2024-44309",
3078
+ "CVE-2024-45519",
2870
3079
  "CVE-2024-48248",
2871
3080
  "CVE-2024-4885",
2872
3081
  "CVE-2024-4889",
2873
3082
  "CVE-2024-49035",
3083
+ "CVE-2024-49039",
3084
+ "CVE-2024-49138",
2874
3085
  "CVE-2024-50050",
2875
3086
  "CVE-2024-50302",
3087
+ "CVE-2024-50603",
3088
+ "CVE-2024-50623",
3089
+ "CVE-2024-51378",
2876
3090
  "CVE-2024-53150",
2877
3091
  "CVE-2024-53197",
2878
3092
  "CVE-2024-54085",
3093
+ "CVE-2024-55550",
3094
+ "CVE-2024-55956",
2879
3095
  "CVE-2024-56145",
2880
3096
  "CVE-2024-57726",
2881
3097
  "CVE-2024-57728",
@@ -2887,8 +3103,16 @@
2887
3103
  "CVE-2024-7694",
2888
3104
  "CVE-2024-8068",
2889
3105
  "CVE-2024-8069",
3106
+ "CVE-2024-9379",
3107
+ "CVE-2024-9380",
3108
+ "CVE-2024-9463",
3109
+ "CVE-2024-9465",
3110
+ "CVE-2024-9474",
3111
+ "CVE-2024-9537",
3112
+ "CVE-2024-9680",
2890
3113
  "CVE-2025-0111",
2891
3114
  "CVE-2025-0282",
3115
+ "CVE-2025-0994",
2892
3116
  "CVE-2025-10035",
2893
3117
  "CVE-2025-10164",
2894
3118
  "CVE-2025-10585",
@@ -2913,10 +3137,16 @@
2913
3137
  "CVE-2025-20393",
2914
3138
  "CVE-2025-21042",
2915
3139
  "CVE-2025-21043",
3140
+ "CVE-2025-21333",
3141
+ "CVE-2025-21334",
3142
+ "CVE-2025-21335",
3143
+ "CVE-2025-21418",
2916
3144
  "CVE-2025-21479",
2917
3145
  "CVE-2025-21480",
2918
3146
  "CVE-2025-21590",
2919
3147
  "CVE-2025-22457",
3148
+ "CVE-2025-23006",
3149
+ "CVE-2025-23209",
2920
3150
  "CVE-2025-23254",
2921
3151
  "CVE-2025-23266",
2922
3152
  "CVE-2025-24016",
@@ -3162,11 +3392,15 @@
3162
3392
  "CVE-2026-45829",
3163
3393
  "CVE-2026-46300",
3164
3394
  "CVE-2026-46333",
3395
+ "CVE-2026-48282",
3165
3396
  "CVE-2026-48558",
3166
3397
  "CVE-2026-48907",
3398
+ "CVE-2026-48908",
3399
+ "CVE-2026-48939",
3167
3400
  "CVE-2026-50751",
3168
3401
  "CVE-2026-5281",
3169
3402
  "CVE-2026-54420",
3403
+ "CVE-2026-56291",
3170
3404
  "CVE-2026-6973",
3171
3405
  "CVE-2026-7473",
3172
3406
  "CVE-2026-9082"
@@ -3205,8 +3439,13 @@
3205
3439
  "CVE-2023-6571",
3206
3440
  "CVE-2024-12366",
3207
3441
  "CVE-2024-2912",
3442
+ "CVE-2024-37383",
3443
+ "CVE-2024-43047",
3444
+ "CVE-2024-43573",
3208
3445
  "CVE-2024-5565",
3446
+ "CVE-2024-8957",
3209
3447
  "CVE-2024-9526",
3448
+ "CVE-2025-0411",
3210
3449
  "CVE-2025-11837",
3211
3450
  "CVE-2025-27363",
3212
3451
  "CVE-2025-27520",
@@ -3300,7 +3539,9 @@
3300
3539
  "real_requirement": "800-63B Rev 4 must add an AAL-A (agent assurance level) construct: per-invocation authenticator binding, capability-scoped tokens (what this agent is permitted to do this run), agent-to-agent delegation chains with non-repudiation, and explicit cross-walk to eIDAS 2.0 attestations, UK GPG 45, AU TDIF, and ISO 29115 for cross-border agent identity.",
3301
3540
  "status": "open",
3302
3541
  "opened_date": "2026-05-11",
3303
- "evidence_cves": [],
3542
+ "evidence_cves": [
3543
+ "CVE-2024-28987"
3544
+ ],
3304
3545
  "atlas_refs": [
3305
3546
  "AML.T0051",
3306
3547
  "AML.T0054"
@@ -3708,6 +3949,8 @@
3708
3949
  "CVE-2023-51765",
3709
3950
  "CVE-2023-51766",
3710
3951
  "CVE-2024-21762",
3952
+ "CVE-2024-29824",
3953
+ "CVE-2024-9379",
3711
3954
  "CVE-2025-0282",
3712
3955
  "CVE-2025-22457",
3713
3956
  "CVE-2025-31161",
@@ -4066,7 +4309,9 @@
4066
4309
  "real_requirement": "CC7 anomaly detection must include AI-specific threat signatures: baseline expected AI API usage per system/process, alert on AI API queries from security-sensitive processes, monitor AI tool action logs for out-of-scope actions, include AI-as-C2 in threat model.",
4067
4310
  "status": "open",
4068
4311
  "opened_date": "2026-02-01",
4069
- "evidence_cves": [],
4312
+ "evidence_cves": [
4313
+ "CVE-2024-9537"
4314
+ ],
4070
4315
  "atlas_refs": [
4071
4316
  "AML.T0096",
4072
4317
  "AML.T0017"
@@ -4240,6 +4485,9 @@
4240
4485
  "status": "open",
4241
4486
  "opened_date": "2026-05-13",
4242
4487
  "evidence_cves": [
4488
+ "CVE-2018-19410",
4489
+ "CVE-2018-9276",
4490
+ "CVE-2020-2883",
4243
4491
  "CVE-2022-1471",
4244
4492
  "CVE-2023-43654",
4245
4493
  "CVE-2023-43791",
@@ -4247,9 +4495,15 @@
4247
4495
  "CVE-2023-48022",
4248
4496
  "CVE-2023-6019",
4249
4497
  "CVE-2023-6021",
4498
+ "CVE-2024-0012",
4250
4499
  "CVE-2024-12776",
4500
+ "CVE-2024-45195",
4251
4501
  "CVE-2024-4889",
4502
+ "CVE-2024-49138",
4503
+ "CVE-2024-57727",
4252
4504
  "CVE-2024-6587",
4505
+ "CVE-2024-7593",
4506
+ "CVE-2024-8956",
4253
4507
  "CVE-2025-1796",
4254
4508
  "CVE-2025-64513",
4255
4509
  "CVE-2025-69286",
@@ -4260,7 +4514,9 @@
4260
4514
  "CVE-2026-26190",
4261
4515
  "CVE-2026-41947",
4262
4516
  "CVE-2026-41950",
4263
- "CVE-2026-50751"
4517
+ "CVE-2026-50751",
4518
+ "CVE-2026-55255",
4519
+ "CVE-2026-56290"
4264
4520
  ],
4265
4521
  "atlas_refs": [
4266
4522
  "AML.T0010",
@@ -4295,7 +4551,13 @@
4295
4551
  "real_requirement": "Security monitoring includes prompt/response content classification on egress to AI providers, MCP tool-call audit trail (model decision + tool name + arguments + result), AI-API traffic baselines per service identity with anomaly alerts, and unified retention covering AI events alongside classical telemetry.",
4296
4552
  "status": "open",
4297
4553
  "opened_date": "2026-05-13",
4298
- "evidence_cves": [],
4554
+ "evidence_cves": [
4555
+ "CVE-2014-2120",
4556
+ "CVE-2024-38094",
4557
+ "CVE-2024-41710",
4558
+ "CVE-2024-49039",
4559
+ "CVE-2025-0994"
4560
+ ],
4299
4561
  "atlas_refs": [
4300
4562
  "AML.T0096",
4301
4563
  "AML.T0024",
@@ -4330,7 +4592,13 @@
4330
4592
  "real_requirement": "Response plans include live kernel patching as a documented capability with operator drill cadence; AI-incident playbooks cover model rollback, prompt classifier updates, MCP allowlist tightening; backups validate AI-system artefacts; recovery clocks align to NIS2 24h + DORA 4h + GDPR 72h notification matrix.",
4331
4593
  "status": "open",
4332
4594
  "opened_date": "2026-05-13",
4333
- "evidence_cves": [],
4595
+ "evidence_cves": [
4596
+ "CVE-2024-20481",
4597
+ "CVE-2024-3393",
4598
+ "CVE-2024-51567",
4599
+ "CVE-2025-21391",
4600
+ "CVE-2025-21418"
4601
+ ],
4334
4602
  "atlas_refs": [],
4335
4603
  "attack_refs": [
4336
4604
  "T1068"
@@ -5434,35 +5702,84 @@
5434
5702
  "evidence_cves": [
5435
5703
  "CVE-2017-12637",
5436
5704
  "CVE-2017-3066",
5705
+ "CVE-2018-14933",
5706
+ "CVE-2018-19410",
5437
5707
  "CVE-2018-8639",
5708
+ "CVE-2018-9276",
5709
+ "CVE-2019-0344",
5710
+ "CVE-2019-11001",
5438
5711
  "CVE-2019-9874",
5439
5712
  "CVE-2019-9875",
5713
+ "CVE-2020-11023",
5714
+ "CVE-2020-15069",
5715
+ "CVE-2020-29574",
5716
+ "CVE-2021-26086",
5717
+ "CVE-2021-44207",
5718
+ "CVE-2022-23227",
5440
5719
  "CVE-2022-43769",
5441
5720
  "CVE-2022-43939",
5442
5721
  "CVE-2023-20118",
5722
+ "CVE-2023-28461",
5443
5723
  "CVE-2023-34192",
5444
5724
  "CVE-2023-3519",
5725
+ "CVE-2023-45727",
5445
5726
  "CVE-2023-6571",
5727
+ "CVE-2024-0012",
5728
+ "CVE-2024-11680",
5446
5729
  "CVE-2024-12366",
5730
+ "CVE-2024-12686",
5447
5731
  "CVE-2024-13159",
5448
5732
  "CVE-2024-13160",
5449
5733
  "CVE-2024-13161",
5450
5734
  "CVE-2024-20439",
5735
+ "CVE-2024-20767",
5451
5736
  "CVE-2024-20953",
5737
+ "CVE-2024-21287",
5738
+ "CVE-2024-28987",
5739
+ "CVE-2024-29059",
5452
5740
  "CVE-2024-2912",
5741
+ "CVE-2024-29824",
5453
5742
  "CVE-2024-38475",
5743
+ "CVE-2024-38813",
5744
+ "CVE-2024-40890",
5745
+ "CVE-2024-40891",
5746
+ "CVE-2024-41710",
5747
+ "CVE-2024-41713",
5748
+ "CVE-2024-43047",
5749
+ "CVE-2024-43093",
5750
+ "CVE-2024-43572",
5751
+ "CVE-2024-43573",
5752
+ "CVE-2024-44308",
5753
+ "CVE-2024-44309",
5454
5754
  "CVE-2024-48248",
5455
5755
  "CVE-2024-4885",
5456
5756
  "CVE-2024-49035",
5457
5757
  "CVE-2024-50302",
5758
+ "CVE-2024-53104",
5458
5759
  "CVE-2024-53150",
5459
5760
  "CVE-2024-53197",
5761
+ "CVE-2024-55550",
5460
5762
  "CVE-2024-5565",
5763
+ "CVE-2024-57727",
5461
5764
  "CVE-2024-57968",
5462
5765
  "CVE-2024-58136",
5766
+ "CVE-2024-7593",
5767
+ "CVE-2024-8956",
5768
+ "CVE-2024-8957",
5769
+ "CVE-2024-9379",
5770
+ "CVE-2024-9380",
5463
5771
  "CVE-2024-9526",
5772
+ "CVE-2024-9537",
5464
5773
  "CVE-2025-0111",
5774
+ "CVE-2025-0411",
5775
+ "CVE-2025-21333",
5776
+ "CVE-2025-21334",
5777
+ "CVE-2025-21335",
5778
+ "CVE-2025-21418",
5779
+ "CVE-2025-23006",
5780
+ "CVE-2025-23209",
5465
5781
  "CVE-2025-24054",
5782
+ "CVE-2025-24085",
5466
5783
  "CVE-2025-24813",
5467
5784
  "CVE-2025-24983",
5468
5785
  "CVE-2025-24984",
@@ -5488,9 +5805,13 @@
5488
5805
  "CVE-2026-20253",
5489
5806
  "CVE-2026-42945",
5490
5807
  "CVE-2026-45659",
5808
+ "CVE-2026-48282",
5491
5809
  "CVE-2026-48558",
5492
5810
  "CVE-2026-48907",
5493
- "CVE-2026-54420"
5811
+ "CVE-2026-48908",
5812
+ "CVE-2026-54420",
5813
+ "CVE-2026-55255",
5814
+ "CVE-2026-56291"
5494
5815
  ],
5495
5816
  "atlas_refs": [],
5496
5817
  "attack_refs": [
@@ -5541,6 +5862,7 @@
5541
5862
  "CVE-2023-6021",
5542
5863
  "CVE-2023-6038",
5543
5864
  "CVE-2023-6571",
5865
+ "CVE-2024-0012",
5544
5866
  "CVE-2024-0129",
5545
5867
  "CVE-2024-0132",
5546
5868
  "CVE-2024-11392",
@@ -5567,9 +5889,11 @@
5567
5889
  "CVE-2024-39722",
5568
5890
  "CVE-2024-42478",
5569
5891
  "CVE-2024-42479",
5892
+ "CVE-2024-47575",
5570
5893
  "CVE-2024-4889",
5571
5894
  "CVE-2024-50050",
5572
5895
  "CVE-2024-5565",
5896
+ "CVE-2024-55956",
5573
5897
  "CVE-2024-6587",
5574
5898
  "CVE-2024-9526",
5575
5899
  "CVE-2025-0282",
@@ -5690,16 +6014,27 @@
5690
6014
  "status": "open",
5691
6015
  "opened_date": "2026-05-15",
5692
6016
  "evidence_cves": [
6017
+ "CVE-2020-29574",
6018
+ "CVE-2021-41277",
5693
6019
  "CVE-2022-0492",
5694
6020
  "CVE-2022-36551",
5695
6021
  "CVE-2023-43791",
5696
6022
  "CVE-2023-47117",
5697
6023
  "CVE-2023-6038",
6024
+ "CVE-2024-0012",
6025
+ "CVE-2024-11680",
5698
6026
  "CVE-2024-12776",
5699
6027
  "CVE-2024-1709",
5700
6028
  "CVE-2024-21182",
6029
+ "CVE-2024-21287",
5701
6030
  "CVE-2024-31462",
6031
+ "CVE-2024-45195",
6032
+ "CVE-2024-47575",
6033
+ "CVE-2024-51378",
6034
+ "CVE-2024-51567",
6035
+ "CVE-2024-57727",
5702
6036
  "CVE-2025-1796",
6037
+ "CVE-2025-24200",
5703
6038
  "CVE-2025-25297",
5704
6039
  "CVE-2025-3248",
5705
6040
  "CVE-2025-3466",
@@ -5721,6 +6056,7 @@
5721
6056
  "CVE-2026-45247",
5722
6057
  "CVE-2026-48172",
5723
6058
  "CVE-2026-50751",
6059
+ "CVE-2026-55255",
5724
6060
  "CVE-2026-7482"
5725
6061
  ],
5726
6062
  "atlas_refs": [
@@ -5816,6 +6152,8 @@
5816
6152
  "CVE-2017-1000353",
5817
6153
  "CVE-2017-7921",
5818
6154
  "CVE-2018-4063",
6155
+ "CVE-2018-9276",
6156
+ "CVE-2019-11001",
5819
6157
  "CVE-2019-19006",
5820
6158
  "CVE-2019-6693",
5821
6159
  "CVE-2020-24363",
@@ -5824,6 +6162,7 @@
5824
6162
  "CVE-2021-22681",
5825
6163
  "CVE-2021-26828",
5826
6164
  "CVE-2021-32030",
6165
+ "CVE-2021-40407",
5827
6166
  "CVE-2022-0492",
5828
6167
  "CVE-2022-37055",
5829
6168
  "CVE-2022-40799",
@@ -5836,14 +6175,27 @@
5836
6175
  "CVE-2023-39780",
5837
6176
  "CVE-2023-50224",
5838
6177
  "CVE-2023-52163",
6178
+ "CVE-2024-12686",
5839
6179
  "CVE-2024-12987",
6180
+ "CVE-2024-30088",
6181
+ "CVE-2024-35250",
5840
6182
  "CVE-2024-37079",
6183
+ "CVE-2024-38094",
6184
+ "CVE-2024-38813",
6185
+ "CVE-2024-40711",
6186
+ "CVE-2024-41710",
5841
6187
  "CVE-2024-43468",
6188
+ "CVE-2024-49138",
5842
6189
  "CVE-2024-54085",
6190
+ "CVE-2024-55550",
5843
6191
  "CVE-2024-56145",
5844
6192
  "CVE-2024-57726",
5845
6193
  "CVE-2024-7694",
5846
6194
  "CVE-2024-8069",
6195
+ "CVE-2024-9380",
6196
+ "CVE-2024-9463",
6197
+ "CVE-2024-9465",
6198
+ "CVE-2025-0994",
5847
6199
  "CVE-2025-10035",
5848
6200
  "CVE-2025-10725",
5849
6201
  "CVE-2025-11371",
@@ -5861,6 +6213,9 @@
5861
6213
  "CVE-2025-20393",
5862
6214
  "CVE-2025-21042",
5863
6215
  "CVE-2025-21043",
6216
+ "CVE-2025-21333",
6217
+ "CVE-2025-21334",
6218
+ "CVE-2025-21335",
5864
6219
  "CVE-2025-24016",
5865
6220
  "CVE-2025-24472",
5866
6221
  "CVE-2025-24893",
@@ -5991,6 +6346,7 @@
5991
6346
  "CVE-2026-48172",
5992
6347
  "CVE-2026-48907",
5993
6348
  "CVE-2026-54420",
6349
+ "CVE-2026-55255",
5994
6350
  "CVE-2026-6973"
5995
6351
  ],
5996
6352
  "atlas_refs": [],
@@ -6071,11 +6427,13 @@
6071
6427
  "opened_date": "2026-05-15",
6072
6428
  "evidence_cves": [
6073
6429
  "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
6430
+ "CVE-2024-53104",
6074
6431
  "CVE-2025-11837",
6075
6432
  "CVE-2025-30400",
6076
6433
  "CVE-2026-11645",
6077
6434
  "CVE-2026-32202",
6078
6435
  "CVE-2026-33825",
6436
+ "CVE-2026-56290",
6079
6437
  "CVE-2026-6973"
6080
6438
  ],
6081
6439
  "atlas_refs": [],
@@ -6202,22 +6560,35 @@
6202
6560
  "CVE-2017-12637",
6203
6561
  "CVE-2017-3066",
6204
6562
  "CVE-2018-8639",
6563
+ "CVE-2019-0344",
6564
+ "CVE-2019-16278",
6205
6565
  "CVE-2019-9874",
6206
6566
  "CVE-2019-9875",
6567
+ "CVE-2020-11023",
6568
+ "CVE-2020-15069",
6569
+ "CVE-2020-15415",
6570
+ "CVE-2020-29574",
6207
6571
  "CVE-2021-20035",
6572
+ "CVE-2021-26086",
6208
6573
  "CVE-2021-33515",
6209
6574
  "CVE-2021-38371",
6575
+ "CVE-2021-44207",
6210
6576
  "CVE-2022-0492",
6577
+ "CVE-2022-23748",
6211
6578
  "CVE-2022-23812",
6212
6579
  "CVE-2022-36551",
6213
6580
  "CVE-2022-43769",
6214
6581
  "CVE-2022-43939",
6215
6582
  "CVE-2023-20118",
6583
+ "CVE-2023-25280",
6584
+ "CVE-2023-28461",
6216
6585
  "CVE-2023-34192",
6217
6586
  "CVE-2023-43791",
6218
6587
  "CVE-2023-44221",
6219
6588
  "CVE-2023-44467",
6589
+ "CVE-2023-45727",
6220
6590
  "CVE-2023-47117",
6591
+ "CVE-2023-48365",
6221
6592
  "CVE-2023-51449",
6222
6593
  "CVE-2023-6016",
6223
6594
  "CVE-2023-6038",
@@ -6228,56 +6599,107 @@
6228
6599
  "CVE-2024-11392",
6229
6600
  "CVE-2024-11393",
6230
6601
  "CVE-2024-11394",
6602
+ "CVE-2024-11667",
6603
+ "CVE-2024-11680",
6604
+ "CVE-2024-1212",
6605
+ "CVE-2024-12356",
6231
6606
  "CVE-2024-12366",
6232
6607
  "CVE-2024-12450",
6608
+ "CVE-2024-12686",
6233
6609
  "CVE-2024-13059",
6234
6610
  "CVE-2024-13159",
6235
6611
  "CVE-2024-13160",
6236
6612
  "CVE-2024-13161",
6237
6613
  "CVE-2024-1561",
6238
6614
  "CVE-2024-20439",
6615
+ "CVE-2024-20767",
6239
6616
  "CVE-2024-20953",
6240
6617
  "CVE-2024-21182",
6618
+ "CVE-2024-21287",
6619
+ "CVE-2024-21413",
6241
6620
  "CVE-2024-21513",
6242
6621
  "CVE-2024-21575",
6243
6622
  "CVE-2024-21576",
6244
6623
  "CVE-2024-21762",
6624
+ "CVE-2024-23113",
6245
6625
  "CVE-2024-24590",
6246
6626
  "CVE-2024-24591",
6247
6627
  "CVE-2024-27132",
6628
+ "CVE-2024-29059",
6248
6629
  "CVE-2024-2912",
6630
+ "CVE-2024-29824",
6631
+ "CVE-2024-30088",
6249
6632
  "CVE-2024-31462",
6250
6633
  "CVE-2024-37032",
6251
6634
  "CVE-2024-37052",
6252
6635
  "CVE-2024-37060",
6636
+ "CVE-2024-37383",
6253
6637
  "CVE-2024-38475",
6638
+ "CVE-2024-38812",
6639
+ "CVE-2024-38813",
6254
6640
  "CVE-2024-39722",
6641
+ "CVE-2024-40711",
6642
+ "CVE-2024-40890",
6643
+ "CVE-2024-40891",
6644
+ "CVE-2024-41713",
6255
6645
  "CVE-2024-42478",
6256
6646
  "CVE-2024-42479",
6647
+ "CVE-2024-43047",
6648
+ "CVE-2024-43093",
6649
+ "CVE-2024-43451",
6650
+ "CVE-2024-43572",
6651
+ "CVE-2024-43573",
6652
+ "CVE-2024-44308",
6653
+ "CVE-2024-44309",
6654
+ "CVE-2024-45519",
6655
+ "CVE-2024-47575",
6257
6656
  "CVE-2024-48248",
6258
6657
  "CVE-2024-4885",
6259
6658
  "CVE-2024-49035",
6260
6659
  "CVE-2024-50050",
6261
6660
  "CVE-2024-50302",
6661
+ "CVE-2024-50603",
6662
+ "CVE-2024-50623",
6663
+ "CVE-2024-51378",
6664
+ "CVE-2024-53104",
6262
6665
  "CVE-2024-53150",
6263
6666
  "CVE-2024-53197",
6667
+ "CVE-2024-53704",
6668
+ "CVE-2024-55550",
6669
+ "CVE-2024-55591",
6264
6670
  "CVE-2024-5565",
6265
6671
  "CVE-2024-57968",
6266
6672
  "CVE-2024-58136",
6673
+ "CVE-2024-5910",
6267
6674
  "CVE-2024-6047",
6675
+ "CVE-2024-8957",
6676
+ "CVE-2024-8963",
6677
+ "CVE-2024-9379",
6678
+ "CVE-2024-9380",
6679
+ "CVE-2024-9474",
6268
6680
  "CVE-2024-9526",
6681
+ "CVE-2024-9680",
6682
+ "CVE-2025-0108",
6269
6683
  "CVE-2025-0111",
6270
6684
  "CVE-2025-0282",
6685
+ "CVE-2025-0411",
6271
6686
  "CVE-2025-10164",
6272
6687
  "CVE-2025-1316",
6273
6688
  "CVE-2025-1550",
6274
6689
  "CVE-2025-1753",
6275
6690
  "CVE-2025-1976",
6691
+ "CVE-2025-21333",
6692
+ "CVE-2025-21334",
6693
+ "CVE-2025-21335",
6276
6694
  "CVE-2025-21590",
6277
6695
  "CVE-2025-22457",
6696
+ "CVE-2025-23006",
6697
+ "CVE-2025-23209",
6278
6698
  "CVE-2025-23254",
6279
6699
  "CVE-2025-23266",
6280
6700
  "CVE-2025-24054",
6701
+ "CVE-2025-24085",
6702
+ "CVE-2025-24200",
6281
6703
  "CVE-2025-24472",
6282
6704
  "CVE-2025-24813",
6283
6705
  "CVE-2025-24983",
@@ -6366,9 +6788,13 @@
6366
6788
  "CVE-2026-46300",
6367
6789
  "CVE-2026-46333",
6368
6790
  "CVE-2026-48172",
6791
+ "CVE-2026-48282",
6369
6792
  "CVE-2026-48558",
6370
6793
  "CVE-2026-48907",
6794
+ "CVE-2026-48908",
6795
+ "CVE-2026-48939",
6371
6796
  "CVE-2026-54420",
6797
+ "CVE-2026-56291",
6372
6798
  "CVE-2026-5760",
6373
6799
  "CVE-2026-7473",
6374
6800
  "CVE-2026-8398",
@@ -6406,6 +6832,8 @@
6406
6832
  "status": "open",
6407
6833
  "opened_date": "2026-05-17",
6408
6834
  "evidence_cves": [
6835
+ "CVE-2020-29574",
6836
+ "CVE-2021-44207",
6409
6837
  "CVE-2022-0492",
6410
6838
  "CVE-2022-1471",
6411
6839
  "CVE-2022-36551",
@@ -6431,6 +6859,7 @@
6431
6859
  "CVE-2024-12776",
6432
6860
  "CVE-2024-13059",
6433
6861
  "CVE-2024-1561",
6862
+ "CVE-2024-20481",
6434
6863
  "CVE-2024-21182",
6435
6864
  "CVE-2024-21513",
6436
6865
  "CVE-2024-21575",
@@ -6439,28 +6868,34 @@
6439
6868
  "CVE-2024-24590",
6440
6869
  "CVE-2024-24591",
6441
6870
  "CVE-2024-27132",
6871
+ "CVE-2024-28987",
6442
6872
  "CVE-2024-2912",
6443
6873
  "CVE-2024-31462",
6444
6874
  "CVE-2024-37032",
6445
6875
  "CVE-2024-37052",
6446
6876
  "CVE-2024-37060",
6447
6877
  "CVE-2024-39722",
6878
+ "CVE-2024-41713",
6448
6879
  "CVE-2024-42478",
6449
6880
  "CVE-2024-42479",
6881
+ "CVE-2024-43093",
6450
6882
  "CVE-2024-4889",
6451
6883
  "CVE-2024-50050",
6452
6884
  "CVE-2024-5565",
6453
6885
  "CVE-2024-6047",
6454
6886
  "CVE-2024-6587",
6887
+ "CVE-2024-8963",
6455
6888
  "CVE-2024-9526",
6456
6889
  "CVE-2025-0282",
6457
6890
  "CVE-2025-10164",
6458
6891
  "CVE-2025-1550",
6459
6892
  "CVE-2025-1753",
6460
6893
  "CVE-2025-1796",
6894
+ "CVE-2025-21391",
6461
6895
  "CVE-2025-22457",
6462
6896
  "CVE-2025-23254",
6463
6897
  "CVE-2025-23266",
6898
+ "CVE-2025-24200",
6464
6899
  "CVE-2025-25297",
6465
6900
  "CVE-2025-27363",
6466
6901
  "CVE-2025-27520",
@@ -6531,6 +6966,7 @@
6531
6966
  "CVE-2026-46300",
6532
6967
  "CVE-2026-46333",
6533
6968
  "CVE-2026-48172",
6969
+ "CVE-2026-48908",
6534
6970
  "CVE-2026-50751",
6535
6971
  "CVE-2026-5760",
6536
6972
  "CVE-2026-7473",
@@ -6566,6 +7002,8 @@
6566
7002
  "status": "open",
6567
7003
  "opened_date": "2026-05-17",
6568
7004
  "evidence_cves": [
7005
+ "CVE-2024-9537",
7006
+ "CVE-2025-24200",
6569
7007
  "CVE-2025-34291",
6570
7008
  "CVE-2026-46300",
6571
7009
  "CVE-2026-46333"
@@ -6828,20 +7266,32 @@
6828
7266
  "status": "open",
6829
7267
  "opened_date": "2026-05-18",
6830
7268
  "evidence_cves": [
7269
+ "CVE-2018-19410",
6831
7270
  "CVE-2020-10148",
7271
+ "CVE-2021-44207",
6832
7272
  "CVE-2022-1471",
7273
+ "CVE-2022-23227",
6833
7274
  "CVE-2023-43654",
6834
7275
  "CVE-2023-48022",
6835
7276
  "CVE-2023-6016",
6836
7277
  "CVE-2023-6019",
6837
7278
  "CVE-2023-6021",
6838
7279
  "CVE-2023-6038",
7280
+ "CVE-2024-11680",
6839
7281
  "CVE-2024-12776",
6840
7282
  "CVE-2024-1709",
6841
7283
  "CVE-2024-21182",
7284
+ "CVE-2024-28987",
6842
7285
  "CVE-2024-2912",
7286
+ "CVE-2024-43451",
7287
+ "CVE-2024-47575",
6843
7288
  "CVE-2024-4889",
7289
+ "CVE-2024-53704",
7290
+ "CVE-2024-55591",
7291
+ "CVE-2024-5910",
6844
7292
  "CVE-2024-6587",
7293
+ "CVE-2024-7593",
7294
+ "CVE-2024-8956",
6845
7295
  "CVE-2025-1796",
6846
7296
  "CVE-2025-27520",
6847
7297
  "CVE-2025-3248",
@@ -6966,8 +7416,12 @@
6966
7416
  "status": "open",
6967
7417
  "opened_date": "2026-05-18",
6968
7418
  "evidence_cves": [
7419
+ "CVE-2014-2120",
7420
+ "CVE-2020-2883",
6969
7421
  "CVE-2021-20035",
7422
+ "CVE-2021-40407",
6970
7423
  "CVE-2022-36551",
7424
+ "CVE-2023-25280",
6971
7425
  "CVE-2023-44221",
6972
7426
  "CVE-2023-44487",
6973
7427
  "CVE-2023-50387",
@@ -6975,9 +7429,18 @@
6975
7429
  "CVE-2023-51764",
6976
7430
  "CVE-2023-51765",
6977
7431
  "CVE-2023-51766",
7432
+ "CVE-2024-11667",
7433
+ "CVE-2024-1212",
6978
7434
  "CVE-2024-12450",
7435
+ "CVE-2024-20481",
6979
7436
  "CVE-2024-21762",
7437
+ "CVE-2024-23113",
6980
7438
  "CVE-2024-31462",
7439
+ "CVE-2024-3393",
7440
+ "CVE-2024-38812",
7441
+ "CVE-2024-50603",
7442
+ "CVE-2024-9474",
7443
+ "CVE-2025-0108",
6981
7444
  "CVE-2025-0282",
6982
7445
  "CVE-2025-10164",
6983
7446
  "CVE-2025-1316",
@@ -7006,6 +7469,7 @@
7006
7469
  "CVE-2026-34909",
7007
7470
  "CVE-2026-34910",
7008
7471
  "CVE-2026-50751",
7472
+ "CVE-2026-56290",
7009
7473
  "CVE-2026-5760",
7010
7474
  "CVE-2026-7473"
7011
7475
  ],
@@ -7266,7 +7730,8 @@
7266
7730
  "status": "open",
7267
7731
  "opened_at": "2026-05-18",
7268
7732
  "evidence_cves": [
7269
- "CVE-2025-21085"
7733
+ "CVE-2025-21085",
7734
+ "CVE-2025-21391"
7270
7735
  ],
7271
7736
  "theater_test": {
7272
7737
  "claim": "We are compliant with AU-9 (Protection of Audit Information) because we follow the documented requirement: Protecting audit information and audit logging tools from unauthorized access, modification, and deletion. Anchored on the threat model that the adversary is trying to tamper with logs after the fact.",
@@ -7350,6 +7815,7 @@
7350
7815
  "status": "open",
7351
7816
  "opened_at": "2026-05-18",
7352
7817
  "evidence_cves": [
7818
+ "CVE-2024-9465",
7353
7819
  "CVE-2025-1094"
7354
7820
  ],
7355
7821
  "theater_test": {
@@ -7379,11 +7845,25 @@
7379
7845
  "opened_at": "2026-05-18",
7380
7846
  "evidence_cves": [
7381
7847
  "BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
7848
+ "CVE-2018-19410",
7849
+ "CVE-2018-9276",
7850
+ "CVE-2019-11001",
7851
+ "CVE-2021-40407",
7852
+ "CVE-2021-41277",
7382
7853
  "CVE-2024-11120",
7854
+ "CVE-2024-29059",
7855
+ "CVE-2024-37383",
7856
+ "CVE-2024-41710",
7857
+ "CVE-2024-43093",
7858
+ "CVE-2024-45195",
7859
+ "CVE-2024-5910",
7383
7860
  "CVE-2024-6047",
7861
+ "CVE-2024-8957",
7862
+ "CVE-2025-0108",
7384
7863
  "CVE-2025-49844",
7385
7864
  "CVE-2025-59529",
7386
- "CVE-2025-8671"
7865
+ "CVE-2025-8671",
7866
+ "CVE-2026-48939"
7387
7867
  ],
7388
7868
  "theater_test": {
7389
7869
  "claim": "We are compliant with A.8.9 (Configuration management) because we follow the documented requirement: Annex A.8.9 — establishing, documenting, implementing, monitoring, and reviewing configurations of hardware, software, services, and networks. Anchored on a documented baseline and continuous monitori",
@@ -7499,7 +7979,11 @@
7499
7979
  "status": "open",
7500
7980
  "opened_at": "2026-05-18",
7501
7981
  "evidence_cves": [
7982
+ "CVE-2024-37383",
7983
+ "CVE-2024-43451",
7502
7984
  "CVE-2025-14847",
7985
+ "CVE-2025-23209",
7986
+ "CVE-2026-55255",
7503
7987
  "MAL-2025-PYPI-COLORAMA-SOLANA-STEALER"
7504
7988
  ],
7505
7989
  "theater_test": {
@@ -7908,6 +8392,8 @@
7908
8392
  "status": "open",
7909
8393
  "opened_at": "2026-05-18",
7910
8394
  "evidence_cves": [
8395
+ "CVE-2024-40711",
8396
+ "CVE-2024-50623",
7911
8397
  "CVE-2025-22225"
7912
8398
  ],
7913
8399
  "theater_test": {
@@ -8466,17 +8952,34 @@
8466
8952
  "status": "open",
8467
8953
  "opened_date": "2026-05-18",
8468
8954
  "evidence_cves": [
8955
+ "CVE-2019-16278",
8469
8956
  "CVE-2019-6693",
8470
8957
  "CVE-2020-17103-REREGRESSION-2026",
8471
8958
  "CVE-2022-0492",
8472
8959
  "CVE-2023-21529",
8473
8960
  "CVE-2023-27351",
8961
+ "CVE-2023-48365",
8962
+ "CVE-2024-12356",
8474
8963
  "CVE-2024-1708",
8475
8964
  "CVE-2024-21182",
8476
8965
  "CVE-2024-27199",
8966
+ "CVE-2024-37383",
8967
+ "CVE-2024-45195",
8968
+ "CVE-2024-45519",
8969
+ "CVE-2024-47575",
8970
+ "CVE-2024-50623",
8971
+ "CVE-2024-51378",
8972
+ "CVE-2024-53704",
8477
8973
  "CVE-2024-57726",
8478
8974
  "CVE-2024-57728",
8975
+ "CVE-2024-5910",
8976
+ "CVE-2024-8963",
8977
+ "CVE-2024-9463",
8978
+ "CVE-2024-9465",
8979
+ "CVE-2024-9680",
8980
+ "CVE-2025-0994",
8479
8981
  "CVE-2025-10035",
8982
+ "CVE-2025-24200",
8480
8983
  "CVE-2025-27363",
8481
8984
  "CVE-2025-30400",
8482
8985
  "CVE-2025-48595",
@@ -8493,7 +8996,8 @@
8493
8996
  "CVE-2026-20131",
8494
8997
  "CVE-2026-23760",
8495
8998
  "CVE-2026-24423",
8496
- "CVE-2026-41940"
8999
+ "CVE-2026-41940",
9000
+ "CVE-2026-48939"
8497
9001
  ],
8498
9002
  "theater_test": {
8499
9003
  "claim": "Vulnerability handling and disclosure procedures align with NIS2 Art.21 obligations.",
@@ -8519,7 +9023,10 @@
8519
9023
  "status": "open",
8520
9024
  "opened_date": "2026-05-18",
8521
9025
  "evidence_cves": [
8522
- "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND"
9026
+ "BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
9027
+ "CVE-2024-20481",
9028
+ "CVE-2024-3393",
9029
+ "CVE-2024-49039"
8523
9030
  ],
8524
9031
  "theater_test": {
8525
9032
  "claim": "System monitoring effectively detects compromise and security-control degradation per NIST 800-53 SI-4.",