@blamejs/exceptd-skills 0.18.28 → 0.18.29

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.18.29 — 2026-08-06
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (923 → 1023), covering KEV additions from August 2022 through March 2023 plus five from July and August 2026, and spanning CVE publication years 2010 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. Thirty-two carry known ransomware use.
+
+The batch centers on the late-2022 enterprise-edge and mail-infrastructure wave — the Exchange OWASSRF chain that bypassed the ProxyNotShell URL rewrite (CVE-2022-41080, CVE-2022-41082, CVE-2022-41040), the Fortinet FortiOS SSL-VPN heap overflow behind the BOLDMOVE and COATHANGER implants (CVE-2022-42475), the Fortinet management-interface authentication bypass (CVE-2022-40684), the Citrix ADC and Gateway SAML bypass attributed to APT5 (CVE-2022-27518), the Fortra GoAnywhere MFT deserialization RCE Cl0p weaponized as a zero-day (CVE-2023-0669), the Veeam Backup & Replication unauthenticated internal-API pair used by Cuba, Conti and Yanluowang (CVE-2022-26500, CVE-2022-26501), the Zoho ManageEngine SAML RCE (CVE-2022-47966, CVE-2022-35405), the Zimbra path traversal chained through cpio (CVE-2022-41352), the SAP Internet Communication Manager request-smuggling flaw (CVE-2022-22536), the Oracle E-Business Suite and Fusion Middleware pre-auth flaws (CVE-2022-21587, CVE-2021-35587), and the Sophos Firewall code injection Sophos disclosed alongside its own targeted-exploitation notice (CVE-2022-3236).
+
+Windows kernel and platform escalation is the other center of gravity: the CLFS driver overflows used ahead of ransomware deployment (CVE-2023-23376, CVE-2022-37969), the ALPC and COM+ Event System escalations (CVE-2023-21674, CVE-2022-41033), the CNG Key Isolation flaw reachable inside LSA (CVE-2022-41125), the Print Spooler activation-context escape (CVE-2022-41073), the JScript9 type confusion delivered through Office remote templates by APT37 (CVE-2022-41128), both Mark-of-the-Web bypasses (CVE-2022-41049, CVE-2022-41091), the Defender SmartScreen bypass (CVE-2022-44698), the Active Directory Certificate Services escalation known as Certifried (CVE-2022-26923), and the LNK shortcut flaw Stuxnet used (CVE-2010-2568). Client-side and mobile exploitation covers the Samsung clipboard-provider chain into the Mali and DPU drivers (CVE-2021-25337, CVE-2021-25369, CVE-2021-25370), Apple WebKit and kernel zero-days across iOS, iPadOS and macOS (CVE-2023-23529, CVE-2022-42856, CVE-2022-42827, CVE-2022-32917, CVE-2022-32893, CVE-2022-32894, CVE-2021-31010, CVE-2020-9934), Chromium V8, GPU, Mojo and Intents zero-days (CVE-2022-4262, CVE-2022-4135, CVE-2022-3723, CVE-2022-3075, CVE-2022-2856), and the WebRTC heap overflow Candiru used to deliver DevilsTongue (CVE-2022-2294). A long tail of Linux and Android privilege escalation (CVE-2021-3493, CVE-2013-6282, CVE-2013-2596, CVE-2013-2094, CVE-2011-1823, CVE-2013-2597), signed-driver escalation primitives suitable for bring-your-own-vulnerable-driver (CVE-2018-19320 through CVE-2018-19323, CVE-2015-2291), and internet-facing devices recruited into botnets (CVE-2018-6530, CVE-2022-26258, CVE-2011-4723, CVE-2017-5521, CVE-2018-7445) rounds out the set.
+
+Eight weakness classes backing these entries are new to the CWE catalog: CWE-197 (numeric truncation), CWE-259 (hard-coded password), CWE-270 (privilege context switching error), CWE-311 (missing encryption of sensitive data), CWE-406 (network amplification), CWE-664 (improper control of a resource through its lifetime), CWE-824 (access of uninitialized pointer), and CWE-1285 (improper validation of a specified index, position or offset). CVE-2013-2094 now maps to CWE-1285 rather than the CWE-189 category, which MITRE prohibits using to map real-world vulnerabilities.
+
 ## 0.18.28 — 2026-08-05
 
 `doctor` no longer reports a healthy install as failed once a skill passes ninety days since its last threat review. The skill-currency check treated every skill outside the "current" tier as an error, while the currency model itself raises `action_required` only below the "acceptable" tier — so a maintained skill crossing the ninety-day mark turned the whole health check red and `doctor --json` exited 1, on a fixed cadence, with nothing actually wrong. Review-date drift is now advisory: the check reports `severity: "warn"`, `all_green` stays false so the drift is still visible, and the exit code stays 0. A skill genuinely past its review window still fails with exit 1, and a critically stale one is still counted critical. The check reports `drifting_skills` and `action_required_skills` alongside the existing `stale_skills` list, which keeps its meaning, so a consumer can distinguish an advisory state from a failure. Human output distinguishes the three states rather than printing "all green" under a warning icon.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-06T01:23:34.879Z",
+  "generated_at": "2026-08-08T00:13:19.714Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "b33b921f81ee69e65fcc3cda6480e50e726c3a1846817e7409ed2f5d63178d6c",
+    "manifest.json": "839bcf37cf7551affca5e013e2201220cb48fe8dd5d5c640e85859ec372a8271",
     "README.md": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "0f9d29c33502294e383da8c747d491ee972d1d6923695cecd110e8c9f6d53522",
-    "data/cve-catalog.json": "85afca7bff24a802ddd15b3b9f3b0951c35ab3232e79307718e6bad1d6f75c4c",
-    "data/cwe-catalog.json": "2075d9e36a95656817389ae5cc671ddc396ac532077a3b1c2eda20730c93c87d",
+    "data/attack-techniques.json": "dd42496983df0e69993c14c2b8b53bbd06ebf0c1193fef4bf8aad2bae7e990de",
+    "data/cve-catalog.json": "7cd922abf720e5b0b84878eb33e84c6b3c8c68a579c9ae76793f56723a4de82c",
+    "data/cwe-catalog.json": "0066d80fbb4551e6678948c1ba9dde888aca6cc097a356e5725e7b3d8f9b4b48",
     "data/d3fend-catalog.json": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "2490bffb1511f5157de8c8894267c509e6e8e27cd40e47df455f7550c06de866",
+    "data/framework-control-gaps.json": "37849a64a83e8d12176dad0a165017e9b7107caeba2da968f0d0411295a1970b",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "5d293b1e2240dd40df948cb8fe40fd4637cda8d625a3b29d1d2731f36cbcbdf4",
+    "data/zeroday-lessons.json": "f88d344e8400051bcfcd13ba116326e02fb188cf451c48bc4115fd3f9a7143b7",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,8 +101,8 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 910,
-    "chains_cwe_entries": 220,
+    "chains_cve_entries": 1010,
+    "chains_cwe_entries": 232,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,

package/data/_indexes/activity-feed.json

@@ -5,6 +5,30 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-08-06",
+      "type": "catalog_update",
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
+      "schema_version": "1.0.0",
+      "entry_count": 1023
+    },
+    {
+      "date": "2026-08-06",
+      "type": "catalog_update",
+      "artifact": "data/cwe-catalog.json",
+      "path": "data/cwe-catalog.json",
+      "schema_version": "1.0.0",
+      "entry_count": 232
+    },
+    {
+      "date": "2026-08-06",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 1023
+    },
     {
       "date": "2026-08-05",
       "type": "skill_review",
@@ -34,30 +58,6 @@
       "schema_version": "1.0.0",
       "entry_count": 8889
     },
-    {
-      "date": "2026-07-30",
-      "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 923
-    },
-    {
-      "date": "2026-07-30",
-      "type": "catalog_update",
-      "artifact": "data/cwe-catalog.json",
-      "path": "data/cwe-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 220
-    },
-    {
-      "date": "2026-07-22",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 923
-    },
     {
       "date": "2026-07-03",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-30",
+      "last_updated": "2026-08-06",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 923,
+      "entry_count": 1023,
       "sample_keys": [
         "CVE-2025-68686",
         "CVE-2026-16812",
@@ -75,7 +75,7 @@
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-30",
+      "last_updated": "2026-08-06",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 220,
+      "entry_count": 232,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-07-22",
+      "last_updated": "2026-08-06",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 923,
+      "entry_count": 1023,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",