@blamejs/exceptd-skills 0.18.25 → 0.18.26

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.18.26 — 2026-07-22
+
+Every CVE in the offline catalog now declares a framework-control-gap statement for all five jurisdiction buckets — NIST, EU (NIS2/DORA), UK (CAF), AU (Essential 8/ISM), and ISO 27001:2022. Previously two-thirds of the catalog mapped only a subset, so operators subject to multiple regimes reading the framework-gap output got US- or EU-centric coverage on most entries. The remaining partial entries have been completed with vulnerability-specific gap statements — each tied to that CVE's own exploitation profile (exploitation window, attack vector, end-of-life status, blast radius) and resolving to a real control in the framework-control-gap catalog — bringing the whole catalog to full multi-jurisdiction coverage. A new predeploy gate enforces this, so a newly-curated CVE can no longer ship with a partial jurisdiction set.
+
 ## 0.18.25 — 2026-07-22
 
 CVE catalog currency: four more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (819 → 823), covering CISA Known Exploited Vulnerabilities catalog additions dated 2026-07-21. The set is the WordPress Core "wp2shell" pre-authentication remote-code-execution chain — CVE-2026-60137 (SQL injection in the WP_Query author__not_in parameter) plus CVE-2026-63030 (a REST batch-endpoint interpretation conflict that desynchronizes handler dispatch) — which reaches default installations of WordPress 6.9.x and 7.0.x and carries an accelerated three-day KEV deadline; CVE-2026-0770, an unauthenticated code-execution flaw in Langflow's /api/v1/validate/code endpoint (exec() over attacker-supplied Python), for which GitHub's advisory records no fixed release, so the effective control is removing endpoint exposure and network-isolating the service rather than patching; and CVE-2021-27137, a DD-WRT UPnP/SSDP stack buffer overflow patched in 2021 but newly weaponized in 2026 by the Gafgyt/C0XMO botnet to recruit routers as DDoS bots. Each entry carries a verified CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators, global-first framework-control-gap declarations across NIST, EU NIS2, UK CAF, AU Essential 8, and ISO 27001, an RWEP score, and a paired zero-day lesson.

package/data/_indexes/_meta.json

@@ -1,19 +1,19 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-23T04:30:27.503Z",
+  "generated_at": "2026-07-23T13:14:46.671Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "ff620f4315eb55c04983b4a6426bbedc2b3ed152ab033b412c475ab16666f410",
+    "manifest.json": "4207cec11036cf109667a54673ac7de7aa7ef4110a3193a09c0879699c64369f",
     "README.md": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
     "data/attack-techniques.json": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457",
-    "data/cve-catalog.json": "d2380ef0293cd71331766955e2d9d5bd630bb106160de242ad23c004a2b678f7",
+    "data/cve-catalog.json": "662031d56c6ab7364328176339ae8f474c6312f288ca3d5154c8c31c7f5c86dd",
     "data/cwe-catalog.json": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634",
     "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "a4f8e629f7a94dd38def59b6adca6fc59726671cba6662a033e576bd70316b33",
+    "data/framework-control-gaps.json": "f0bfc430eebdc5818179805f73b236fbbbc73763e5f11c4905aade9cacd41fd4",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
     "data/zeroday-lessons.json": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b",