@blamejs/exceptd-skills 0.18.22 → 0.18.23

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.18.23 — 2026-07-18
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (619 → 719), covering additions to the CISA Known Exploited Vulnerabilities catalog from March 2024 through July 2026 and spanning CVE publication years 2008 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Palo Alto PAN-OS GlobalProtect command injection exploited as a zero-day (CVE-2024-3400), the PHP-CGI argument-injection RCE mass-exploited by TellYouThePass ransomware (CVE-2024-4577), a Linux kernel nf_tables use-after-free local privilege escalation (CVE-2024-1086), the Fortinet FortiClientEMS SQL-injection RCE (CVE-2023-48788), the Cisco ASA/FTD pair used in the ArcaneDoor campaign (CVE-2024-20353, CVE-2024-20359), the Check Point Security Gateway information disclosure (CVE-2024-24919), a VMware ESXi authentication bypass abused by ransomware affiliates (CVE-2024-37085), the OSGeo GeoServer evaluation RCE (CVE-2024-36401), the ServiceNow Now Platform input-validation RCE chain (CVE-2024-4879, CVE-2024-5217), and recent Microsoft SharePoint (CVE-2026-58644, CVE-2026-56164), Active Directory Federation Services (CVE-2026-56155), Oracle E-Business Suite (CVE-2026-46817), Fortinet FortiSandbox (CVE-2026-25089, CVE-2026-39808), and SonicWall SMA1000 (CVE-2026-15409, CVE-2026-15410) additions — alongside client and browser exploitation including six Google Chrome/V8 flaws (CVE-2024-4671, CVE-2024-4761, CVE-2024-4947, CVE-2024-5274, CVE-2024-7965, CVE-2024-7971), the Windows MSHTML spoofing flaw used by Void Banshee to deliver the Atlantida stealer (CVE-2024-43461), an Android Pixel firmware privilege escalation (CVE-2024-32896), and the Justice AV Solutions Viewer supply-chain backdoor (CVE-2024-4978). Fourteen weakness classes backing these entries are new to the CWE catalog: CWE-27, CWE-80, CWE-184, CWE-191, CWE-203, CWE-276, CWE-280, CWE-358, CWE-415, CWE-591, CWE-645, CWE-670, CWE-783, and CWE-1336.
+
 ## 0.18.22 — 2026-07-11
 
 CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (519 → 619), covering the most recent additions to the CISA Known Exploited Vulnerabilities catalog (September 2024 through July 2026). Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch spans internet-facing edge and enterprise infrastructure — Palo Alto PAN-OS management auth bypass (CVE-2025-0108), SonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704), Fortinet FortiManager "FortiJump" (CVE-2024-47575) and the FortiOS fgfmd format-string RCE (CVE-2024-23113), SimpleHelp path traversal on RMM servers (CVE-2024-57727), an Ivanti Cloud Services Appliance path-traversal chain (CVE-2024-8963), Veeam Backup & Replication deserialization RCE (CVE-2024-40711), Trimble Cityworks deserialization (CVE-2025-0994), and Microsoft SharePoint code injection (CVE-2024-38094) — alongside client and mobile exploitation such as the Apple iOS USB Restricted Mode bypass used in targeted attacks (CVE-2025-24200), a Firefox animation-timeline use-after-free deployed by RomCom (CVE-2024-9680), the Windows NTLM hash-disclosure flaw (CVE-2024-43451), and an Android Framework privilege escalation (CVE-2024-43093). Two of the hundred were AI-assisted discoveries, including the PTZOptics camera command-injection pair surfaced by an LLM triaging honeypot traffic (CVE-2024-8956, CVE-2024-8957); the Langflow server-side code execution flaw is also included (CVE-2026-55255). Six weakness classes backing these entries are new to the CWE catalog: CWE-114, CWE-134, CWE-176, CWE-273, CWE-303, and CWE-425.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-11T23:54:45.339Z",
+  "generated_at": "2026-07-18T08:08:40.009Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "640ae4a66f3db19b0cb14761f45be4de1d432d0728f402cff45c1a4cb62807a7",
+    "manifest.json": "6c40bb0b1c80d38a2756501524b074e0885bf99d234ecdc4c66176bd232ee699",
     "README.md": "91d223cb15dacbeb16642b2f4e0afcd41e086d33a10006a6d3b686f76ae32539",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "8bfd00768b038f17601ad8cab9d4efee4bb5dd9319dc9924c6724be2fa37864c",
-    "data/cve-catalog.json": "59e9b78bcc2f36e76ff9fad7fd3ca20feae799da8ff889e202db312c1c7b330b",
-    "data/cwe-catalog.json": "0fe9c3d27daddaf1edf287ee7b8cbbdc004ab656e54abed41f8ddbe739df29eb",
+    "data/attack-techniques.json": "14fd17a88f5ddbd37dae6cface6114f95e4c6d8409f0cf8ce050a5369b88568d",
+    "data/cve-catalog.json": "f5d27d4ff1452fd0f40e45c9aaecae16a0910fb12b695e9353a6090d9d11608e",
+    "data/cwe-catalog.json": "ed975d2500ea655b89007cee5de3afac0f5cd5720d3175a92a4382ddd8774ff7",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "832547285529fdeb8110d39d471120cfee3053a8b2de3de1a9350715ef518732",
+    "data/framework-control-gaps.json": "87a3ef8628ec7e1339a25ac047cf0c7cdaa82bd6d3db9e8257141d9656a9bd33",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "96556be0a5fe8f4f72fb3924cc7caf6d8f801cbeb12b85816cf8b0e1af7e81e6",
+    "data/zeroday-lessons.json": "bf2ef195d95d795c08e42b1ff3a214e4a637b108309afc69977d15f25dab10f6",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 606,
-    "chains_cwe_entries": 199,
+    "chains_cve_entries": 706,
+    "chains_cwe_entries": 213,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -6,20 +6,28 @@
   },
   "events": [
     {
-      "date": "2026-07-03",
+      "date": "2026-07-18",
       "type": "catalog_update",
-      "artifact": "data/atlas-ttps.json",
-      "path": "data/atlas-ttps.json",
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 170
+      "entry_count": 719
     },
     {
-      "date": "2026-07-03",
+      "date": "2026-07-18",
       "type": "catalog_update",
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 199
+      "entry_count": 213
+    },
+    {
+      "date": "2026-07-03",
+      "type": "catalog_update",
+      "artifact": "data/atlas-ttps.json",
+      "path": "data/atlas-ttps.json",
+      "schema_version": "1.0.0",
+      "entry_count": 170
     },
     {
       "date": "2026-07-03",
@@ -27,7 +35,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 619
+      "entry_count": 719
     },
     {
       "date": "2026-06-10",
@@ -324,14 +332,6 @@
       "path": "skills/privacy-consent-ops/skill.md",
       "note": "Privacy, consent, and sanctions operational integrity for mid-2026 — confusable/homoglyph normalization before sanctions screening, integrity-bound and re-validated consent records, evidence-gated and downstream-propagated DSR erasure, and ROPA reconciliation against actual processing"
     },
-    {
-      "date": "2026-06-01",
-      "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 619
-    },
     {
       "date": "2026-05-27",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-06-01",
+      "last_updated": "2026-07-18",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,20 +62,20 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 619,
+      "entry_count": 719,
       "sample_keys": [
-        "CVE-2026-56291",
-        "CVE-2026-48939",
-        "CVE-2026-56290",
-        "CVE-2026-55255",
-        "CVE-2026-48908"
+        "CVE-2026-58644",
+        "CVE-2026-25089",
+        "CVE-2026-39808",
+        "CVE-2026-46817",
+        "CVE-2023-4346"
       ]
     },
     "cwe-catalog.json": {
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-03",
+      "last_updated": "2026-07-18",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 199,
+      "entry_count": 213,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 619,
+      "entry_count": 719,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",