@blamejs/exceptd-skills 0.18.21 → 0.18.23

package/ARCHITECTURE.md

@@ -176,7 +176,7 @@ Tracks PoC status, weaponization stage, and AI-assist factor per CVE. Updated wh
 
 ### `data/cwe-catalog.json`
 
-193 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
+199 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE; the CWE provides the durable root-cause lens that survives across exploit generations.
 
 `_meta.cwe_version` pins the version; on a CWE release, audit IDs for renames or deprecations, bump `last_threat_review` on affected skills, and update `_meta`.
 

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.18.23 — 2026-07-18
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (619 → 719), covering additions to the CISA Known Exploited Vulnerabilities catalog from March 2024 through July 2026 and spanning CVE publication years 2008 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Palo Alto PAN-OS GlobalProtect command injection exploited as a zero-day (CVE-2024-3400), the PHP-CGI argument-injection RCE mass-exploited by TellYouThePass ransomware (CVE-2024-4577), a Linux kernel nf_tables use-after-free local privilege escalation (CVE-2024-1086), the Fortinet FortiClientEMS SQL-injection RCE (CVE-2023-48788), the Cisco ASA/FTD pair used in the ArcaneDoor campaign (CVE-2024-20353, CVE-2024-20359), the Check Point Security Gateway information disclosure (CVE-2024-24919), a VMware ESXi authentication bypass abused by ransomware affiliates (CVE-2024-37085), the OSGeo GeoServer evaluation RCE (CVE-2024-36401), the ServiceNow Now Platform input-validation RCE chain (CVE-2024-4879, CVE-2024-5217), and recent Microsoft SharePoint (CVE-2026-58644, CVE-2026-56164), Active Directory Federation Services (CVE-2026-56155), Oracle E-Business Suite (CVE-2026-46817), Fortinet FortiSandbox (CVE-2026-25089, CVE-2026-39808), and SonicWall SMA1000 (CVE-2026-15409, CVE-2026-15410) additions — alongside client and browser exploitation including six Google Chrome/V8 flaws (CVE-2024-4671, CVE-2024-4761, CVE-2024-4947, CVE-2024-5274, CVE-2024-7965, CVE-2024-7971), the Windows MSHTML spoofing flaw used by Void Banshee to deliver the Atlantida stealer (CVE-2024-43461), an Android Pixel firmware privilege escalation (CVE-2024-32896), and the Justice AV Solutions Viewer supply-chain backdoor (CVE-2024-4978). Fourteen weakness classes backing these entries are new to the CWE catalog: CWE-27, CWE-80, CWE-184, CWE-191, CWE-203, CWE-276, CWE-280, CWE-358, CWE-415, CWE-591, CWE-645, CWE-670, CWE-783, and CWE-1336.
+
+## 0.18.22 — 2026-07-11
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (519 → 619), covering the most recent additions to the CISA Known Exploited Vulnerabilities catalog (September 2024 through July 2026). Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch spans internet-facing edge and enterprise infrastructure — Palo Alto PAN-OS management auth bypass (CVE-2025-0108), SonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704), Fortinet FortiManager "FortiJump" (CVE-2024-47575) and the FortiOS fgfmd format-string RCE (CVE-2024-23113), SimpleHelp path traversal on RMM servers (CVE-2024-57727), an Ivanti Cloud Services Appliance path-traversal chain (CVE-2024-8963), Veeam Backup & Replication deserialization RCE (CVE-2024-40711), Trimble Cityworks deserialization (CVE-2025-0994), and Microsoft SharePoint code injection (CVE-2024-38094) — alongside client and mobile exploitation such as the Apple iOS USB Restricted Mode bypass used in targeted attacks (CVE-2025-24200), a Firefox animation-timeline use-after-free deployed by RomCom (CVE-2024-9680), the Windows NTLM hash-disclosure flaw (CVE-2024-43451), and an Android Framework privilege escalation (CVE-2024-43093). Two of the hundred were AI-assisted discoveries, including the PTZOptics camera command-injection pair surfaced by an LLM triaging honeypot traffic (CVE-2024-8956, CVE-2024-8957); the Langflow server-side code execution flaw is also included (CVE-2026-55255). Six weakness classes backing these entries are new to the CWE catalog: CWE-114, CWE-134, CWE-176, CWE-273, CWE-303, and CWE-425.
+
+Batch curation tooling: the new `exceptd refresh --curate-batch` command promotes a set of KEV drafts into fully-curated catalog entries from a facts file and a per-CVE judgment file in one pass, refusing to write any entry whose CWE, ATT&CK, or framework-control references are not already present in their catalogs. The nightly data refresh now pre-enriches newly-KEV-listed CVEs with NVD (CVSS, CWE) and FIRST EPSS data at import time and raises the per-run discovery cap from twenty to one hundred, so auto-imported drafts arrive with their mechanical fields already populated; `vendor_advisories` now reflects only real vendor advisories rather than a placeholder, so the catalog-gap detector correctly surfaces entries still missing one.
+
 ## 0.18.21 — 2026-07-03
 
 CVE catalog currency: twenty more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (519 total), each carrying a verified NVD CVSS vector and CWE, an ATT&CK technique mapping, behavioral indicators, global-first framework-control-gap declarations, an RWEP score, and a paired zero-day lesson. The additions cover Microsoft SharePoint Server deserialization (CVE-2026-45659) and the Windows MSC "EvilTwin" console-file bypass exploited by EncryptHub/Water Gamayun (CVE-2025-26633); the SimpleHelp OIDC signature-verification bypass on internet-facing RMM servers (CVE-2026-48558); the three Ivanti Endpoint Manager credential-coercion path traversals (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161); the Advantive VeraCore upload and SQL-injection pair used by XE Group (CVE-2024-57968, CVE-2025-25181); a Linux kernel HID information leak used in a Cellebrite Android-unlock chain (CVE-2024-50302); Progress WhatsUp Gold path-traversal RCE (CVE-2024-4885); a Windows Win32k local privilege escalation (CVE-2018-8639); the Hitachi Vantara Pentaho BA Server authorization-bypass-plus-injection chain (CVE-2022-43769, CVE-2022-43939); the end-of-life Cisco Small Business RV command injection abused by the PolarEdge botnet (CVE-2023-20118); Zimbra Collaboration Suite stored XSS (CVE-2023-34192); Microsoft Partner Center (CVE-2024-49035) and Power Pages (CVE-2025-24989) access-control flaws; Oracle Agile PLM (CVE-2024-20953) and Adobe ColdFusion BlazeDS (CVE-2017-3066) deserialization RCE; and the Palo Alto PAN-OS authenticated arbitrary file read that attackers chain with the CVE-2025-0108 auth bypass (CVE-2025-0111). Four weakness classes backing these entries are new to the CWE catalog: CWE-707, CWE-404, CWE-647, and CWE-610.

package/bin/exceptd.js

@@ -718,10 +718,13 @@ function main() {
     // data slice without requiring a full package upgrade.
     effectiveCmd = "refresh-network";
     effectiveRest = rest.filter(a => a !== "--network");
-  } else if (cmd === "refresh" && rest.includes("--curate")) {
+  } else if (cmd === "refresh" && (rest.includes("--curate") || rest.includes("--curate-batch"))) {
     // v0.12.0: --curate <CVE-ID> emits editorial questions + ranked
     // candidates (atlas/attack/cwe/framework) for a draft catalog entry.
     // Operator or AI assistant fills the null editorial fields.
+    // --curate-batch <facts+judgments files> assembles + writes many
+    // gate-passing entries in one shot; cve-curation.js's cli() branches
+    // to lib/cve-batch.js when it sees the flag.
     effectiveCmd = "refresh-curate";
     effectiveRest = rest;
   }

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-03T23:38:50.552Z",
+  "generated_at": "2026-07-18T08:08:40.009Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "b347a576339f0abe2d01349f956e205872eba35dbc508cd4e8746d21313b5a45",
+    "manifest.json": "6c40bb0b1c80d38a2756501524b074e0885bf99d234ecdc4c66176bd232ee699",
     "README.md": "91d223cb15dacbeb16642b2f4e0afcd41e086d33a10006a6d3b686f76ae32539",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "2673046f2180b548157b6e57e6b75648e03f094d83a442704c449a4822e4bf17",
-    "data/cve-catalog.json": "4e7bdca6cf824de60ef014f6f73352655f28bd68c9f04a8bf59e3c813bd0f464",
-    "data/cwe-catalog.json": "588c3f76992b196ba4f8673f308ffa355209153a8e8599eec7735115ebeb88a8",
+    "data/attack-techniques.json": "14fd17a88f5ddbd37dae6cface6114f95e4c6d8409f0cf8ce050a5369b88568d",
+    "data/cve-catalog.json": "f5d27d4ff1452fd0f40e45c9aaecae16a0910fb12b695e9353a6090d9d11608e",
+    "data/cwe-catalog.json": "ed975d2500ea655b89007cee5de3afac0f5cd5720d3175a92a4382ddd8774ff7",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "72fa93815f5c26c8289e63eadcff40509f86b41b86038bff919470ae7082c0f4",
+    "data/framework-control-gaps.json": "87a3ef8628ec7e1339a25ac047cf0c7cdaa82bd6d3db9e8257141d9656a9bd33",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "209fc9ce17db5341e189e447160bf207b545edb9f7ef585a90024e7f067f2aa4",
+    "data/zeroday-lessons.json": "bf2ef195d95d795c08e42b1ff3a214e4a637b108309afc69977d15f25dab10f6",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 506,
-    "chains_cwe_entries": 193,
+    "chains_cve_entries": 706,
+    "chains_cwe_entries": 213,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -6,20 +6,28 @@
   },
   "events": [
     {
-      "date": "2026-07-03",
+      "date": "2026-07-18",
       "type": "catalog_update",
-      "artifact": "data/atlas-ttps.json",
-      "path": "data/atlas-ttps.json",
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 170
+      "entry_count": 719
     },
     {
-      "date": "2026-07-03",
+      "date": "2026-07-18",
       "type": "catalog_update",
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 193
+      "entry_count": 213
+    },
+    {
+      "date": "2026-07-03",
+      "type": "catalog_update",
+      "artifact": "data/atlas-ttps.json",
+      "path": "data/atlas-ttps.json",
+      "schema_version": "1.0.0",
+      "entry_count": 170
     },
     {
       "date": "2026-07-03",
@@ -27,7 +35,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 519
+      "entry_count": 719
     },
     {
       "date": "2026-06-10",
@@ -324,14 +332,6 @@
       "path": "skills/privacy-consent-ops/skill.md",
       "note": "Privacy, consent, and sanctions operational integrity for mid-2026 — confusable/homoglyph normalization before sanctions screening, integrity-bound and re-validated consent records, evidence-gated and downstream-propagated DSR erasure, and ROPA reconciliation against actual processing"
     },
-    {
-      "date": "2026-06-01",
-      "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 519
-    },
     {
       "date": "2026-05-27",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-06-01",
+      "last_updated": "2026-07-18",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,20 +62,20 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 519,
+      "entry_count": 719,
       "sample_keys": [
-        "CVE-2026-45659",
-        "CVE-2026-48558",
-        "CVE-2025-26633",
-        "CVE-2024-13161",
-        "CVE-2024-13160"
+        "CVE-2026-58644",
+        "CVE-2026-25089",
+        "CVE-2026-39808",
+        "CVE-2026-46817",
+        "CVE-2023-4346"
       ]
     },
     "cwe-catalog.json": {
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-03",
+      "last_updated": "2026-07-18",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 193,
+      "entry_count": 213,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 519,
+      "entry_count": 719,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",