@blamejs/exceptd-skills 0.18.24 → 0.18.25

package/data/attack-techniques.json

@@ -539,6 +539,7 @@
       "CVE-2026-48282",
       "CVE-2026-5760",
       "CVE-2026-58644",
+      "CVE-2026-63030",
       "CVE-2026-6973"
     ],
     "description_full": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)",
@@ -589,6 +590,7 @@
       "CVE-2024-5565",
       "CVE-2025-3248",
       "CVE-2025-49844",
+      "CVE-2026-0770",
       "CVE-2026-31230",
       "CVE-2026-33017",
       "MAL-2026-3083"
@@ -1249,6 +1251,9 @@
     "description": "Adversaries may create a local account to maintain access to victim systems.",
     "tactic": [
       "Persistence"
+    ],
+    "cve_refs": [
+      "CVE-2026-63030"
     ]
   },
   "T1190": {
@@ -1315,6 +1320,7 @@
       "CVE-2021-26086",
       "CVE-2021-26828",
       "CVE-2021-26829",
+      "CVE-2021-27137",
       "CVE-2021-31196",
       "CVE-2021-3129",
       "CVE-2021-32030",
@@ -1668,6 +1674,7 @@
       "CVE-2026-0257",
       "CVE-2026-0300",
       "CVE-2026-0766",
+      "CVE-2026-0770",
       "CVE-2026-10520",
       "CVE-2026-12569",
       "CVE-2026-1281",
@@ -1754,6 +1761,8 @@
       "CVE-2026-56291",
       "CVE-2026-5760",
       "CVE-2026-58644",
+      "CVE-2026-60137",
+      "CVE-2026-63030",
       "CVE-2026-6973",
       "CVE-2026-7473",
       "CVE-2026-7482",
@@ -2089,7 +2098,8 @@
       "CVE-2026-20133",
       "CVE-2026-21858",
       "CVE-2026-22218",
-      "CVE-2026-41950"
+      "CVE-2026-41950",
+      "CVE-2026-60137"
     ]
   },
   "T1485": {
@@ -2427,6 +2437,7 @@
       "CVE-2024-48248",
       "CVE-2024-6587",
       "CVE-2025-21085",
+      "CVE-2026-0770",
       "CVE-2026-30615",
       "MAL-2026-3083",
       "MAL-2026-MOIKA-DEPCONFUSION",
@@ -2487,6 +2498,9 @@
     "description": "Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.",
     "tactic": [
       "Credential Access"
+    ],
+    "cve_refs": [
+      "CVE-2026-0770"
     ]
   },
   "T1552.007": {
@@ -3482,6 +3496,7 @@
     "name": "Network Denial of Service",
     "version": "v19",
     "cve_refs": [
+      "CVE-2021-27137",
       "CVE-2023-44487",
       "CVE-2023-50387",
       "CVE-2023-50868",
@@ -5429,6 +5444,7 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2008-4250",
+      "CVE-2021-27137",
       "CVE-2023-34048",
       "CVE-2024-12356",
       "CVE-2024-38812",
@@ -13044,7 +13060,8 @@
       "CVE-2026-48939",
       "CVE-2026-56290",
       "CVE-2026-56291",
-      "CVE-2026-58644"
+      "CVE-2026-58644",
+      "CVE-2026-63030"
     ]
   },
   "T1505.004": {

package/data/cve-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-07-18",
+    "last_updated": "2026-07-22",
     "source": "NVD + CISA KEV + vendor advisories — see sources/index.json",
     "required_fields": [
       "type",
@@ -82446,5 +82446,408 @@
     "_kev_short_description": "Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
     "_draft": false,
     "curation_note": "Promoted from KEV-import draft on 2026-06-28: NVD CVSS + CWE retained, ATT&CK + IOCs derived from the Win32k use-after-free privilege escalation, framework gaps mapped global-first, and a paired zero-day lesson added."
+  },
+  "CVE-2026-60137": {
+    "name": "WordPress Core SQL Injection Vulnerability",
+    "cvss_score": 5.9,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
+    "cwe_refs": [
+      "CWE-89"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-07-21",
+    "cisa_kev_due_date": "2026-08-04",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "WordPress Core mishandles the author__not_in parameter of WP_Query, allowing SQL injection when untrusted input reaches the parameter; chained with CVE-2026-63030 for unauthenticated remote code execution.",
+    "epss_score": 0.20395,
+    "epss_percentile": 0.97219,
+    "epss_date": "2026-07-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-60137",
+    "vendor_advisories": [
+      {
+        "vendor": "WordPress",
+        "advisory_id": "GHSA-fpp7-x2x2-2mjf",
+        "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf",
+        "severity": "medium",
+        "published_date": "2026-07-17"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-60137",
+      "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/"
+    ],
+    "source_verified": "2026-07-22",
+    "last_updated": "2026-07-22",
+    "_kev_short_description": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.",
+    "type": "sql-injection-rce-chain",
+    "blast_radius": 28,
+    "poc_available": true,
+    "poc_description": "Public \"wp2shell\" PoCs. The author__not_in parameter of WP_Query is interpolated into raw SQL as a scalar string; REST parameter validation normally blocks this, but chaining CVE-2026-63030 (a REST batch-route desynchronization) smuggles the injection past validation unauthenticated. The SQLi primitive is then used to read/manipulate the database as part of the pre-auth RCE chain (forge an admin account, upload a malicious plugin).",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated requests to /wp-json/batch/v1 immediately followed by creation of a new administrator account",
+        "SQL errors or anomalous WP_Query execution referencing author__not_in from unauthenticated REST traffic",
+        "Plugin upload (.zip) via wp-admin shortly after an unauthenticated batch request"
+      ],
+      "indicators": [
+        "REST requests carrying an author__not_in value with SQL metacharacters",
+        "WordPress Core 6.8.0-6.8.5 / 6.9.0-6.9.4 / 7.0.0-7.0.1",
+        "Requests to ?rest_route=/batch/v1 or /wp-json/batch/v1 from unauthenticated sources"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-60137 (CWE-89, CVSS 5.9) + WordPress GHSA-fpp7-x2x2-2mjf + Rapid7 wp2shell analysis."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Reported to WordPress via responsible disclosure by TF1T, dtro, and haongo. No AI tooling credited.",
+    "ai_discovery_source": "vendor_research",
+    "discovery_attribution_note": "Curated from NVD CVE-2026-60137 (CWE-89, CVSS 5.9 WPScan CNA) + CISA KEV (added 2026-07-21) + WordPress GHSA-fpp7-x2x2-2mjf.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-08-04). Named vendors (Rapid7, Tenable, IONIX) report in-the-wild exploitation of the wp2shell chain within days of the 2026-07-17 disclosure. Standalone, the SQLi is only reachable when a plugin/theme passes untrusted input (hence the AC:H / 5.9 CNA rating); its real-world weight is as the SQLi half of the unauthenticated RCE chain.",
+    "attack_refs": [
+      "T1190",
+      "T1213"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "A 30-day flaw-remediation SLA is far slower than the observed window: public wp2shell exploitation followed the 2026-07-17 release within days, so a periodic patch cycle cannot close the SQLi half of the chain before mass compromise.",
+      "NIS2-Art21-vulnerability-management": "Coordinated vulnerability-management expectations do not compel the emergency, same-week patching a KEV-listed pre-auth RCE chain on internet-facing CMS demands, nor the WAF blocking of /wp-json/batch/v1 that actually breaks the chain.",
+      "UK-CAF-B4": "System-security expectations do not by themselves require validating that plugin/theme code never forwards untrusted input into WP_Query parameters like author__not_in, which is the reachability precondition this SQLi exploits.",
+      "AU-Essential-8-Patch": "Essential-Eight patch maturity (48h internet-facing) still trails the same-week exploitation, and app-hardening controls do not address that this SQLi becomes unauthenticated only when combined with a separate Core routing flaw.",
+      "ISO-27001-2022-A.8.8": "Periodic technical-vulnerability management does not compel the input-validation review of the WP_Query surface that would prevent untrusted data reaching author__not_in in the first place."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch mechanism; WordPress.org enabled forced automatic security updates. Remediation is upgrading to 6.8.6 / 6.9.5 / 7.0.2.",
+    "affected": "WordPress Core WP_Query author__not_in parameter permits SQL injection when a plugin or theme passes untrusted input; chainable with CVE-2026-63030 for unauthenticated RCE on default installations.",
+    "affected_versions": [
+      "WordPress Core 6.8.0 - 6.8.5",
+      "WordPress Core 6.9.0 - 6.9.4",
+      "WordPress Core 7.0.0 - 7.0.1"
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 28,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 78,
+    "rwep_notes": "RWEP 78. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +28, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2026-63030": {
+    "name": "WordPress Core Interpretation Conflict Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-436"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-07-21",
+    "cisa_kev_due_date": "2026-07-24",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "WordPress Core REST API batch endpoint (/wp-json/batch/v1) has an array-desynchronization interpretation conflict that misroutes handler dispatch, letting an unauthenticated attacker bypass validation to perform SQL injection and achieve remote code execution; chained with CVE-2026-60137.",
+    "epss_score": 0.38599,
+    "epss_percentile": 0.98425,
+    "epss_date": "2026-07-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-63030",
+    "vendor_advisories": [
+      {
+        "vendor": "WordPress",
+        "advisory_id": "GHSA-ff9f-jf42-662q",
+        "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q",
+        "severity": "critical",
+        "published_date": "2026-07-17"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-63030",
+      "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q",
+      "https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    ],
+    "source_verified": "2026-07-22",
+    "last_updated": "2026-07-22",
+    "_kev_short_description": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.",
+    "type": "interpretation-conflict-preauth-rce",
+    "blast_radius": 29,
+    "poc_available": true,
+    "poc_description": "Public \"wp2shell\" PoCs. The REST batch processor at /wp-json/batch/v1 has an array desynchronization: when validation fails on a sub-request the error is pushed to one array but not another, so subsequent sub-requests dispatch under the wrong handler. An unauthenticated attacker smuggles the CVE-2026-60137 SQLi past validation, forges a WordPress administrator account, logs in, and uploads a malicious plugin for arbitrary code execution (Rapid7).",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated POST to /wp-json/batch/v1 with multiple sub-requests, followed by a new administrator user",
+        "Malicious plugin (.zip) upload and subsequent PHP process spawning a shell",
+        "Successful admin-authenticated actions with no preceding legitimate login"
+      ],
+      "indicators": [
+        "Requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 from unauthenticated sources with crafted sub-request arrays",
+        "WordPress Core 6.9.0-6.9.4 / 7.0.0-7.0.1",
+        "New admin accounts created immediately after a batch request"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-63030 (CWE-436, CVSS 9.8) + WordPress GHSA-ff9f-jf42-662q + Rapid7 wp2shell analysis."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Reported to WordPress via responsible disclosure by Adam Kues of Assetnote / Searchlight Cyber. No AI tooling credited.",
+    "ai_discovery_source": "vendor_research",
+    "discovery_attribution_note": "Curated from NVD CVE-2026-63030 (CWE-436, CVSS 9.8 WPScan CNA) + CISA KEV (added 2026-07-21) + WordPress GHSA-ff9f-jf42-662q + Rapid7 disclosure.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "Added to CISA KEV 2026-07-21 with an accelerated 3-day due date (2026-07-24). Multiple vendors (Rapid7, Tenable, NetSPI, CyCognito) confirm in-the-wild exploitation of the wp2shell pre-auth RCE chain against default WordPress installs. This CVE is the route-confusion half that provides the validation bypass; CVE-2026-60137 provides the SQLi primitive. Temporary mitigation: block /wp-json/batch/v1 at a WAF.",
+    "attack_refs": [
+      "T1190",
+      "T1505.003",
+      "T1136.001",
+      "T1059"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "The 30-day flaw-remediation SLA is defeated by an accelerated 3-day KEV deadline: this pre-auth RCE was exploited in the wild within days of disclosure, so any periodic patch cadence leaves default installs owned before the ticket is even triaged.",
+      "NIS2-Art21-incident-handling": "Incident-handling requirements assume detection of a breach, but an unauthenticated single-request chain that forges an admin and drops a plugin can complete before any monitoring fires; the control does not mandate the WAF virtual-patch of /wp-json/batch/v1 that actually blocks it pre-patch.",
+      "UK-CAF-B4": "System-security expectations do not by themselves require removing or authenticating the REST batch endpoint whose handler-dispatch confusion is the entire vulnerability, leaving default internet-facing installs reachable unauthenticated.",
+      "AU-Essential-8-Patch": "Essential-Eight 48h patch maturity for internet-facing systems still trails the same-week mass exploitation, and does not address that the flaw yields code execution on a DEFAULT install with no plugins, config, or credentials required.",
+      "ISO-27001-2022-A.8.8": "Periodic technical-vulnerability management cannot compel the emergency out-of-band upgrade to 6.9.5 / 7.0.2 that a KEV-listed unauthenticated RCE with a 3-day remediation window demands."
+    },
+    "patch_available": true,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch mechanism; WordPress.org enabled forced automatic security updates. Remediation is upgrading to 6.9.5 / 7.0.2; interim mitigation is WAF-blocking /wp-json/batch/v1.",
+    "affected": "WordPress Core REST API batch endpoint (WP_REST_Server batch v1) has an interpretation-conflict/array-desynchronization that misroutes handler dispatch, enabling unauthenticated validation bypass, SQL injection, and remote code execution on default installations; chainable with CVE-2026-60137.",
+    "affected_versions": [
+      "WordPress Core 6.9.0 - 6.9.4",
+      "WordPress Core 7.0.0 - 7.0.1"
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 29,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 79,
+    "rwep_notes": "RWEP 79. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +29, patch_available -15. Σ factors === rwep_score."
+  },
+  "CVE-2026-0770": {
+    "name": "Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-829"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-07-21",
+    "cisa_kev_due_date": "2026-07-24",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Langflow exposes an unauthenticated /api/v1/validate/code endpoint whose validate_code() passes attacker-supplied Python to exec() with an exec_globals context exposing importlib and builtins, yielding remote code execution as the Langflow process.",
+    "epss_score": 0.54503,
+    "epss_percentile": 0.98911,
+    "epss_date": "2026-07-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2026-0770",
+    "vendor_advisories": [
+      {
+        "vendor": "Langflow",
+        "advisory_id": "GHSA-g22f-v6f7-2hrh",
+        "url": "https://github.com/advisories/GHSA-g22f-v6f7-2hrh",
+        "severity": "critical",
+        "published_date": "2026-01-23"
+      },
+      {
+        "vendor": "Zero Day Initiative",
+        "advisory_id": "ZDI-26-036",
+        "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-036/",
+        "severity": "critical",
+        "published_date": "2026-01-09"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-0770",
+      "https://github.com/advisories/GHSA-g22f-v6f7-2hrh",
+      "https://www.zerodayinitiative.com/advisories/ZDI-26-036/",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    ],
+    "source_verified": "2026-07-22",
+    "last_updated": "2026-07-22",
+    "_kev_short_description": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.",
+    "type": "code-injection-rce",
+    "blast_radius": 17,
+    "poc_available": true,
+    "poc_description": "Multiple public PoCs (affix, 0xgh057r3c0n, diamorphine666) and an Exploit-DB entry. An unauthenticated POST to /api/v1/validate/code reaches validate_code(), which passes attacker Python to exec() using an exec_globals context that exposes importlib and builtins. The attacker imports os/subprocess/socket and runs commands; code executes during function definition (decorator / default-argument evaluation), and output is exfiltrated by raising an exception whose message carries it. Executes in the Langflow process context (root in default container deployments).",
+    "iocs": {
+      "behavioral": [
+        "Unauthenticated POST requests to /api/v1/validate/code carrying Python source with import/exec constructs",
+        "Langflow process spawning os/subprocess children or outbound connections to attacker infrastructure",
+        "Access to cloud instance-metadata (169.254.169.254) or reads of AWS credential/env files shortly after a validate/code request"
+      ],
+      "indicators": [
+        "POST /api/v1/validate/code from unauthenticated sources",
+        "Langflow <= 1.7.3 (default port 7860)",
+        "Payloads referencing importlib, __import__, subprocess, or os.system in the code field"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2026-0770 (CWE-829, CVSS 9.8) + ZDI-26-036 + GHSA-g22f-v6f7-2hrh + KEVIntel in-the-wild telemetry."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Discovered and reported by human researchers at Trend Research via the Zero Day Initiative (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira). No AI tooling credited. Note: Langflow is an LLM/agent application framework, but this flaw is a conventional unauthenticated web-app RCE, not a model-level attack.",
+    "ai_discovery_source": "vendor_research",
+    "discovery_attribution_note": "Curated from NVD CVE-2026-0770 (CWE-829, CVSS 9.8) + CISA KEV (added 2026-07-21) + ZDI-26-036 (ZDI-CAN-27325) + GHSA-g22f-v6f7-2hrh. Distinct from CVE-2025-3248 (a separate flaw on the same endpoint, fixed in the 1.3.x line); CVE-2026-0770 is in exec_globals handling and reaches installs up to 1.7.3.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-07-24). KEVIntel first observed in-the-wild exploitation 2026-06-27 with 220+ attempts from 64 unique IPs, deploying second-stage malware and stealing AWS credentials, environment variables, and container/cloud metadata. Exploitation is opportunistic and mass-scanned, indicating commodity weaponization. Reported to the vendor 2025-07-18; ZDI published it as a zero-day when no fix shipped by the deadline.",
+    "attack_refs": [
+      "T1190",
+      "T1059.006",
+      "T1552.005",
+      "T1552.001"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "A flaw-remediation SLA is moot when GitHub’s advisory records no patched version: SI-2 assumes a vendor fix exists to apply, but this KEV-listed RCE had no confirmed fixed release, so the only real control is removing the exposed /api/v1/validate/code surface, which SI-2 does not compel.",
+      "NIS2-Art21-network-security": "Network-security measures do not by default require isolating an internal AI-development tool like Langflow from untrusted networks, yet unauthenticated internet exposure of port 7860 is exactly what turns this into mass-scanned root RCE.",
+      "UK-CAF-B4": "System-security expectations do not mandate treating an LLM-app framework as a code-execution service that must never accept untrusted input to an eval/exec endpoint, which is the design flaw the exec_globals context exposes.",
+      "AU-Essential-8-App-Hardening": "Application-hardening guidance is written for browsers/office suites and does not address disabling or authenticating a code-validation endpoint that evaluates attacker Python; Essential-Eight patch maturity is also unusable here because no confirmed patched version exists.",
+      "ISO-27001-2022-A.8.8": "Technical-vulnerability management cannot drive a patch that the vendor has not shipped; without a fixed release it does not compel the compensating network isolation and endpoint removal that actually stop exploitation of this unauthenticated exec() surface."
+    },
+    "patch_available": false,
+    "patch_required_reboot": false,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "GitHub Advisory GHSA-g22f-v6f7-2hrh records no patched version (first_patched_version: null) and ZDI published this as a zero-day; a fixed release could not be confirmed from a primary source. CISA KEV required action is vendor mitigation or product discontinuation. Compensating controls: block/remove /api/v1/validate/code exposure, network-isolate Langflow, and do not expose port 7860 to untrusted networks.",
+    "affected": "Langflow (langflow PyPI package) <= 1.7.3 exposes an unauthenticated /api/v1/validate/code endpoint whose validate_code() calls exec() with an exec_globals context exposing importlib and builtins, enabling remote code execution as the Langflow process (root in default containers).",
+    "affected_versions": [
+      "Langflow <= 1.7.3"
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 17,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
+    },
+    "rwep_score": 82,
+    "rwep_notes": "RWEP 82. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +17. Σ factors === rwep_score."
+  },
+  "CVE-2021-27137": {
+    "name": "DD-WRT Stack-Based Buffer Overflow Vulnerability",
+    "cvss_score": 8.1,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-121"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-07-21",
+    "cisa_kev_due_date": "2026-07-24",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "DD-WRT UPnP/SSDP handler (ssdp.c, ssdp_msearch) performs an unbounded strcpy of a user-supplied oversized ST-header value into a fixed 128-byte stack buffer, allowing an unauthenticated attacker to overflow the buffer and achieve code execution.",
+    "epss_score": 0.10809,
+    "epss_percentile": 0.95377,
+    "epss_date": "2026-07-22",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-27137",
+    "vendor_advisories": [
+      {
+        "vendor": "DD-WRT",
+        "advisory_id": "changeset 45724",
+        "url": "https://svn.dd-wrt.com/changeset/45724",
+        "severity": "high",
+        "published_date": "2021-03-24"
+      },
+      {
+        "vendor": "SSD Secure Disclosure",
+        "advisory_id": "SSD Advisory - DD-WRT UPnP Buffer Overflow",
+        "url": "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/",
+        "severity": "high",
+        "published_date": "2021-03-24"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-27137",
+      "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/",
+      "https://svn.dd-wrt.com/changeset/45724",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo"
+    ],
+    "source_verified": "2026-07-22",
+    "last_updated": "2026-07-22",
+    "_kev_short_description": "DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.",
+    "type": "stack-overflow-preauth-rce",
+    "blast_radius": 15,
+    "poc_available": true,
+    "poc_description": "The original SSD Secure Disclosure advisory (Selim Enes Karaduman, 2021-03-24) ships a working PoC: an unauthenticated UDP M-SEARCH request to SSDP port 1900 with an oversized uuid: value in the ST (Search Target) header; the SSDP parser copies this user-controlled data via an unbounded strcpy into a 128-byte stack buffer. The PoC appends 164 \"D\" characters plus a return address to overwrite the saved return address and redirect execution for RCE (or DoS).",
+    "iocs": {
+      "behavioral": [
+        "Oversized SSDP M-SEARCH datagrams to UDP/1900 with an abnormally long ST/uuid: header",
+        "DD-WRT/miniupnpd process crash or restart, or the router beaconing to botnet C2",
+        "Router recruited into DDoS activity (outbound flood traffic)"
+      ],
+      "indicators": [
+        "UDP/1900 M-SEARCH packets with ST header > 128 bytes",
+        "DD-WRT change set 45723 or prior with UPnP enabled",
+        "Gafgyt/C0XMO botnet C2 or scanner indicators on the device"
+      ],
+      "_ioc_source_note": "Anchored to NVD CVE-2021-27137 (CWE-121, CVSS 8.1) + SSD advisory + FortiGuard Labs C0XMO report (2026-06-03)."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Discovered and reported in 2021 by Selim Enes Karaduman (independent researcher) via SSD Secure Disclosure. Predates the AI-discovery era; no AI tooling credited.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Curated from NVD CVE-2021-27137 (CWE-121, CVSS 8.1) + CISA KEV (added 2026-07-21) + SSD Secure Disclosure advisory (2021-03-24) + FortiGuard Labs C0XMO analysis.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "Added to CISA KEV 2026-07-21 (due 2026-07-24), ~5 years after the 2021 patch. FortiGuard Labs (2026-06-03) documents in-the-wild exploitation first seen March 2026 by the Gafgyt botnet variant C0XMO, which recruits vulnerable DD-WRT routers as DDoS bots (19 attack methods; a standalone Python propagation scanner). The CVSS AC:H reflects that UPnP must be enabled (non-default) and is typically LAN-facing unless WAN-exposed by misconfiguration.",
+    "attack_refs": [
+      "T1190",
+      "T1210",
+      "T1498"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "A patch has existed since 2021 (changeset 45724), so SI-2 remediation should have closed this long ago; its 2026 KEV listing shows SI-2 without an enforced end-of-support/asset-refresh policy leaves abandoned consumer/SOHO firmware exploitable years after the fix shipped.",
+      "NIS2-Art21-network-security": "Network-security requirements do not by themselves compel disabling UPnP or blocking UDP/1900 at the WAN edge, which is the control that removes unauthenticated reach to the vulnerable SSDP handler on internet-exposed DD-WRT devices.",
+      "UK-CAF-B4": "System-security expectations rarely extend to embedded router firmware lifecycle, so unmanaged DD-WRT/Buffalo devices running change set 45723 or prior persist unpatched and get recruited into botnets.",
+      "AU-Essential-8-Patch": "Essential-Eight patch maturity is written for OS/application estates and does not model consumer/SOHO router firmware, so devices no one treats as patchable assets remain vulnerable to a five-year-old overflow now weaponized by the C0XMO botnet.",
+      "ISO-27001-2022-A.8.8": "Technical-vulnerability management depends on an asset inventory that enumerates the firmware build; embedded UPnP services on edge routers are routinely outside that inventory, so the fixed changeset is never applied."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live-patch mechanism for router firmware; remediation is flashing a DD-WRT build at or after change set 45724, which requires a device reboot. Interim mitigation: disable UPnP and block UDP/1900 at the WAN edge.",
+    "affected": "DD-WRT (Linux-based router/embedded firmware) change set 45723 or prior; the UPnP/SSDP handler (ssdp.c) performs an unbounded strcpy of an oversized ST-header value into a 128-byte stack buffer, allowing an unauthenticated attacker to trigger code execution. Buffalo devices shipping DD-WRT are also affected.",
+    "affected_versions": [
+      "DD-WRT change set 45723 or prior (fixed in 45724)"
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 20,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 15,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 70,
+    "rwep_notes": "RWEP 70. cisa_kev +25, poc_available +20, active_exploitation +20, blast_radius +15, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   }
 }

package/data/cwe-catalog.json

@@ -451,6 +451,7 @@
       "CVE-2025-57819",
       "CVE-2026-21643",
       "CVE-2026-42208",
+      "CVE-2026-60137",
       "CVE-2026-9082"
     ],
     "framework_controls_partially_addressing": [
@@ -2043,6 +2044,7 @@
       "CVE-2025-32463",
       "CVE-2025-54136",
       "CVE-2025-64496",
+      "CVE-2026-0770",
       "MAL-2026-MOIKA-DEPCONFUSION",
       "MAL-2026-NODE-IPC-STEALER",
       "MAL-2026-SHAI-HULUD-OSS",
@@ -2724,6 +2726,7 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
+      "CVE-2021-27137",
       "CVE-2025-0282",
       "CVE-2025-20352",
       "CVE-2025-22457",
@@ -3367,7 +3370,8 @@
     ],
     "related_weaknesses": [],
     "evidence_cves": [
-      "CVE-2025-48384"
+      "CVE-2025-48384",
+      "CVE-2026-63030"
     ],
     "last_verified": "2026-05-18",
     "notes": "Added v0.13.17 KEV bulk-import round 2."