@blamejs/exceptd-skills 0.18.28 → 0.18.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/CHANGELOG.md +22 -0
  2. package/data/_indexes/_meta.json +10 -10
  3. package/data/_indexes/activity-feed.json +24 -24
  4. package/data/_indexes/catalog-summaries.json +6 -6
  5. package/data/_indexes/chains.json +60901 -465
  6. package/data/_indexes/frequency.json +12 -0
  7. package/data/attack-techniques.json +458 -46
  8. package/data/cve-catalog.json +11030 -259
  9. package/data/cwe-catalog.json +472 -8
  10. package/data/exploit-availability.json +9 -9
  11. package/data/framework-control-gaps.json +517 -7
  12. package/data/zeroday-lessons.json +8821 -16
  13. package/lib/source-advisories.js +10 -0
  14. package/lib/validate-package.js +5 -3
  15. package/manifest-snapshot.json +40 -6
  16. package/manifest-snapshot.sha256 +1 -1
  17. package/manifest.json +53 -53
  18. package/package.json +2 -2
  19. package/sbom.cdx.json +33 -33
package/data/exploit-availability.json CHANGED
@@ -87,11 +87,11 @@
87
87
  "poc_description": "Chain component — exploits ESP/IPsec subsystem. Requires combination with CVE-2026-43500 or independent gadget chain.",
88
88
  "weaponization_stage": "partially_weaponized",
89
89
  "ai_discovery_confirmed": true,
90
- "ai_discovery_source": "vendor_research",
90
+ "ai_discovery_source": "bug_bounty_ai_augmented",
91
91
  "ai_assist_factor": "high",
92
92
  "ai_discovery_notes": "Disclosed by Hyunwoo Kim; AI-assisted discovery assessed as likely by Sysdig + Help Net Security given 9-year exposure gap (ESP path landed Jan 2017) and same primitive class as AI-discovered Copy Fail.",
93
93
  "exploit_complexity": "moderate",
94
- "last_verified": "2026-05-15",
94
+ "last_verified": "2026-08-08",
95
95
  "verification_source": "NVD references, researcher (Hyunwoo Kim) disclosure, Sysdig analysis, Help Net Security"
96
96
  },
97
97
  "CVE-2026-43500": {
@@ -99,11 +99,11 @@
99
99
  "poc_description": "Chain component — RxRPC subsystem. Used with CVE-2026-43284.",
100
100
  "weaponization_stage": "partially_weaponized",
101
101
  "ai_discovery_confirmed": true,
102
- "ai_discovery_source": "vendor_research",
102
+ "ai_discovery_source": "bug_bounty_ai_augmented",
103
103
  "ai_assist_factor": "high",
104
104
  "ai_discovery_notes": "Co-disclosed sibling of CVE-2026-43284; same AI-assisted-discovery assessment applies.",
105
105
  "exploit_complexity": "moderate",
106
- "last_verified": "2026-05-15",
106
+ "last_verified": "2026-08-08",
107
107
  "verification_source": "NVD references, researcher (Hyunwoo Kim) disclosure, Sysdig analysis"
108
108
  },
109
109
  "CVE-2026-45321": {
@@ -141,7 +141,7 @@
141
141
  "exploit_class": "deterministic LPE primitive",
142
142
  "maturity_tier": "PoC",
143
143
  "ai_discovery_confirmed": true,
144
- "ai_discovery_source": "vendor_research",
144
+ "ai_discovery_source": "bug_bounty_ai_augmented",
145
145
  "ai_assist_factor": "very_high",
146
146
  "ai_discovery_notes": "Discovered by William Bowling (Zellic.io / V12 security team) with assistance from Zellic's AI-agentic code-auditing tool. Anchor case for AI-driven autonomous discovery in 2026; cycle-5 backfill correction to the originally-tagged ai_discovery_confirmed=false.",
147
147
  "ai_assisted_weaponization": false,
@@ -150,7 +150,7 @@
150
150
  "active_exploitation": "none",
151
151
  "discovered_at": "2026-05-13",
152
152
  "poc_observed_at": "2026-05-13",
153
- "last_verified": "2026-05-14",
153
+ "last_verified": "2026-08-08",
154
154
  "verification_source": "NVD CVE-2026-46300, V12 security team disclosure, AlmaLinux + CloudLinux advisories, Microsoft Security Blog (Dirty Frag family analysis)"
155
155
  },
156
156
  "CVE-2024-21626": {
@@ -162,9 +162,9 @@
162
162
  "ai_assist_factor": "low",
163
163
  "ai_assisted_weaponization": false,
164
164
  "exploit_complexity": "low",
165
- "active_exploitation": "confirmed",
166
- "last_verified": "2026-05-15",
167
- "verification_source": "NVD, CISA KEV, Snyk Labs Leaky Vessels disclosure"
165
+ "active_exploitation": "none",
166
+ "last_verified": "2026-08-08",
167
+ "verification_source": "NVD, Snyk Labs Leaky Vessels disclosure, CISA KEV catalog (checked 2026-08-08: not listed, and never listed — the catalog carries no entry added on the previously-claimed 2024-04-08)"
168
168
  },
169
169
  "CVE-2024-3094": {
170
170
  "poc_status": "public",