@blamejs/exceptd-skills 0.18.29 → 0.18.30

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.18.30 — 2026-08-08
+
+Three catalog entries claimed CISA KEV membership that CISA has never recorded, and each drew a 25-point RWEP premium from it. CVE-2024-21626 (runc "Leaky Vessels"), CVE-2024-3094 (the xz-utils backdoor) and CVE-2025-1094 (PostgreSQL psql SQL injection) are now recorded as not KEV-listed. CISA's own archived catalog for the dates the entries asserted contains none of them and carries no entry added on those dates at all, and the listing date and due date CVE-2025-1094 carried belong to CVE-2024-57727, the only vulnerability CISA added that day. The KEV catalog URL no longer appears in those entries' verification sources, and two `vendor: "CISA KEV"` advisory rows that recorded listings which never happened are gone. Exploitation status was re-decided on its own evidence rather than swept along: CVE-2024-21626 drops to none — it was found by Snyk Labs research, its only public exploit is that disclosure proof-of-concept, and no in-the-wild use is reported — while CVE-2025-1094 keeps confirmed, because Rapid7 documented its use in the BeyondTrust intrusions, chained with two flaws that genuinely are KEV-listed. Scores move 80 to 35, 70 to 45, and 77 to 52.
+
+KEV state across the whole catalog now reconciles against CISA's live catalog with no disagreements. Two entries CISA had listed were still recorded as unlisted — CVE-2026-45321, which also carries a known ransomware campaign, and CVE-2025-14847 — so both were scoring in the forties against a listed reality; they now score 70 and 72. Two listing dates that were off by a day or three are corrected.
+
+Two newly listed vulnerabilities are curated in (1023 → 1025). CVE-2026-8037 is pre-authentication command injection in Progress Kemp LoadMaster, where an escape routine allocates its buffer without clearing it and never writes a terminating null, so a quote-only `apiuser` value on an unauthenticated request to `/accessv2` lets the shell argument read past its own bytes into a heap spray carried by the same request body — command execution on the appliance terminating TLS for everything behind it, rated EPSS 0.85 at the 99.7th percentile with a public detection template. CVE-2026-63077 is unauthenticated remote code execution in JetBrains TeamCity, where the agent-polling protocol deserializes attacker-controlled XML through an allowlist that kept its default permissions, dropping a JSP polyglot into the webroot and executing as the build server — a build-system takeover with credential access to everything the pipeline touches.
+
+Live EPSS scores replace estimated ones on 59 entries.
+
+The refresh pipeline's advisory feeds no longer force an automated pull request on every run. Those feeds report every CVE seen across Ubuntu, Red Hat, Zero Day Initiative and CISA sources that the catalog does not track — over a thousand on a typical day, and never zero, since the catalog deliberately does not carry every distribution kernel CVE. They were counted as pending catalog writes even though they cannot write the catalog, which held the "changes are pending" condition permanently true and made the daily pull request unconditional. They are now declared report-only, so that signal means what it says.
+
 ## 0.18.29 — 2026-08-06
 
 CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (923 → 1023), covering KEV additions from August 2022 through March 2023 plus five from July and August 2026, and spanning CVE publication years 2010 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. Thirty-two carry known ransomware use.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-08T00:13:19.714Z",
+  "generated_at": "2026-08-08T02:22:51.279Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "839bcf37cf7551affca5e013e2201220cb48fe8dd5d5c640e85859ec372a8271",
+    "manifest.json": "e5968ca169bc1296d7eced291c2c2dba1f33db8c7729591123b1e39e546eba88",
     "README.md": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "dd42496983df0e69993c14c2b8b53bbd06ebf0c1193fef4bf8aad2bae7e990de",
-    "data/cve-catalog.json": "7cd922abf720e5b0b84878eb33e84c6b3c8c68a579c9ae76793f56723a4de82c",
-    "data/cwe-catalog.json": "0066d80fbb4551e6678948c1ba9dde888aca6cc097a356e5725e7b3d8f9b4b48",
+    "data/attack-techniques.json": "7421b89bd0594f01d72e04695aeffec35d9f32fa54ac74994a0d082373f7b51a",
+    "data/cve-catalog.json": "86c19b46830b266819f5d51d22e33895e77c9fa57c8dbdb93d6dcbc38489bf7d",
+    "data/cwe-catalog.json": "27b244f6e82528ddef7923d0ddaca9942db3c49411ff8184c471d9195179803f",
     "data/d3fend-catalog.json": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
-    "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "37849a64a83e8d12176dad0a165017e9b7107caeba2da968f0d0411295a1970b",
+    "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
+    "data/framework-control-gaps.json": "31771df41c66ff5c890fe12a9af2accf97198933c9f65949b04adbe33037fd4d",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "f88d344e8400051bcfcd13ba116326e02fb188cf451c48bc4115fd3f9a7143b7",
+    "data/zeroday-lessons.json": "e3b4ab4430aae788328f821c2fb0a93df7c12c806e2a3a4eca23f9e6bb00100b",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1010,
+    "chains_cve_entries": 1012,
     "chains_cwe_entries": 232,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -6,12 +6,20 @@
   },
   "events": [
     {
-      "date": "2026-08-06",
+      "date": "2026-08-08",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1023
+      "entry_count": 1025
+    },
+    {
+      "date": "2026-08-08",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 1025
     },
     {
       "date": "2026-08-06",
@@ -21,14 +29,6 @@
       "schema_version": "1.0.0",
       "entry_count": 232
     },
-    {
-      "date": "2026-08-06",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 1023
-    },
     {
       "date": "2026-08-05",
       "type": "skill_review",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-06",
+      "last_updated": "2026-08-08",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1023,
+      "entry_count": 1025,
       "sample_keys": [
         "CVE-2025-68686",
         "CVE-2026-16812",
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-08-06",
+      "last_updated": "2026-08-08",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1023,
+      "entry_count": 1025,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",