@blamejs/exceptd-skills 0.18.24 → 0.18.26

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.18.26 — 2026-07-22
+
+Every CVE in the offline catalog now declares a framework-control-gap statement for all five jurisdiction buckets — NIST, EU (NIS2/DORA), UK (CAF), AU (Essential 8/ISM), and ISO 27001:2022. Previously two-thirds of the catalog mapped only a subset, so operators subject to multiple regimes reading the framework-gap output got US- or EU-centric coverage on most entries. The remaining partial entries have been completed with vulnerability-specific gap statements — each tied to that CVE's own exploitation profile (exploitation window, attack vector, end-of-life status, blast radius) and resolving to a real control in the framework-control-gap catalog — bringing the whole catalog to full multi-jurisdiction coverage. A new predeploy gate enforces this, so a newly-curated CVE can no longer ship with a partial jurisdiction set.
+
+## 0.18.25 — 2026-07-22
+
+CVE catalog currency: four more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (819 → 823), covering CISA Known Exploited Vulnerabilities catalog additions dated 2026-07-21. The set is the WordPress Core "wp2shell" pre-authentication remote-code-execution chain — CVE-2026-60137 (SQL injection in the WP_Query author__not_in parameter) plus CVE-2026-63030 (a REST batch-endpoint interpretation conflict that desynchronizes handler dispatch) — which reaches default installations of WordPress 6.9.x and 7.0.x and carries an accelerated three-day KEV deadline; CVE-2026-0770, an unauthenticated code-execution flaw in Langflow's /api/v1/validate/code endpoint (exec() over attacker-supplied Python), for which GitHub's advisory records no fixed release, so the effective control is removing endpoint exposure and network-isolating the service rather than patching; and CVE-2021-27137, a DD-WRT UPnP/SSDP stack buffer overflow patched in 2021 but newly weaponized in 2026 by the Gafgyt/C0XMO botnet to recruit routers as DDoS bots. Each entry carries a verified CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators, global-first framework-control-gap declarations across NIST, EU NIS2, UK CAF, AU Essential 8, and ISO 27001, an RWEP score, and a paired zero-day lesson.
+
 ## 0.18.24 — 2026-07-21
 
 CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (719 → 819), covering additions to the CISA Known Exploited Vulnerabilities catalog from August 2023 through March 2024 and spanning CVE publication years 2014 through 2024. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch is weighted toward internet-facing edge and enterprise infrastructure — the Citrix NetScaler "CitrixBleed" session-token disclosure mass-exploited by ransomware affiliates (CVE-2023-4966), the JetBrains TeamCity authentication bypass (CVE-2024-27198), the Atlassian Confluence broken-access-control and template-injection chain abused by Cerber ransomware (CVE-2023-22515, CVE-2023-22518, CVE-2023-22527), the Cisco IOS XE Web UI privilege-escalation-to-implant chain that compromised tens of thousands of devices (CVE-2023-20198, CVE-2023-20273), the F5 BIG-IP Configuration utility authentication-bypass-to-RCE pair (CVE-2023-46747, CVE-2023-46748), the SysAid path traversal used by Lace Tempest (CVE-2023-47246), the Ivanti EPMM/MobileIron authentication bypass (CVE-2023-35082), the Juniper Junos OS J-Web PHP external-variable-modification chain (CVE-2023-36844), and the Unitronics PLC insecure-default-credential flaw exploited against water utilities (CVE-2023-6448) — alongside client and mobile exploitation including the WinRAR file-name-spoofing code execution (CVE-2023-38831), the Windows SmartScreen and Internet Shortcut security-feature bypasses chained to deliver stealer and RAT payloads (CVE-2023-36025, CVE-2024-21412), the Apple "Operation Triangulation" zero-click WebKit and kernel chain (CVE-2023-41990, CVE-2023-42916, CVE-2023-42917), multiple Google Chrome/V8 zero-days (CVE-2023-4762, CVE-2023-6345, CVE-2024-0519), and the Microsoft Windows kernel privilege escalation used by Lazarus (CVE-2024-21338). Five weakness classes backing these entries are new to the CWE catalog: CWE-295 (improper certificate validation), CWE-351 (insufficient type distinction), CWE-473 (PHP external variable modification), CWE-703 (improper check or handling of exceptional conditions), and CWE-823 (use of out-of-range pointer offset).

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-23T02:32:24.239Z",
+  "generated_at": "2026-07-23T13:14:46.671Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "6d1b779b2fe397bdcb7cd3381a0fa9526875845cdec8ee0cd9496480f2c13bb7",
+    "manifest.json": "4207cec11036cf109667a54673ac7de7aa7ef4110a3193a09c0879699c64369f",
     "README.md": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "b9791cfae3465f95d8c59700b3fcf593e4a7a95e47bd28a18c10a782c4aa7ab7",
-    "data/cve-catalog.json": "c5545943732112ae69ef6d1381d76704e1621821a423bf4cd01b162a9afaae01",
-    "data/cwe-catalog.json": "307122227ce1dd5975e5c602de7a82d538b258cdf2f04b62092a72f7b96f6fb2",
+    "data/attack-techniques.json": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457",
+    "data/cve-catalog.json": "662031d56c6ab7364328176339ae8f474c6312f288ca3d5154c8c31c7f5c86dd",
+    "data/cwe-catalog.json": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "c35e90008b2d99c20e33e341ea5440fc2a24bb10cdba9e709a1d34e069f94565",
+    "data/framework-control-gaps.json": "f0bfc430eebdc5818179805f73b236fbbbc73763e5f11c4905aade9cacd41fd4",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "49ecd1aee2cfc5fe79a4ba0eb3c510d27427d773a5d56d15fef71b4b756b2ec1",
+    "data/zeroday-lessons.json": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 806,
+    "chains_cve_entries": 810,
     "chains_cwe_entries": 218,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -6,12 +6,20 @@
   },
   "events": [
     {
-      "date": "2026-07-18",
+      "date": "2026-07-22",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 819
+      "entry_count": 823
+    },
+    {
+      "date": "2026-07-22",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 823
     },
     {
       "date": "2026-07-18",
@@ -29,14 +37,6 @@
       "schema_version": "1.0.0",
       "entry_count": 170
     },
-    {
-      "date": "2026-07-03",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 819
-    },
     {
       "date": "2026-06-10",
       "type": "skill_review",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-18",
+      "last_updated": "2026-07-22",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 819,
+      "entry_count": 823,
       "sample_keys": [
         "CVE-2024-27198",
         "CVE-2024-23225",
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-07-03",
+      "last_updated": "2026-07-22",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 819,
+      "entry_count": 823,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",