@blamejs/exceptd-skills 0.18.3 → 0.18.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/bin/exceptd.js +6 -1
  3. package/data/_indexes/_meta.json +5 -5
  4. package/data/_indexes/jurisdiction-map.json +17 -2
  5. package/data/d3fend-catalog.json +73 -11
  6. package/data/rfc-references.json +36 -12
  7. package/lib/lint-skills.js +12 -1
  8. package/manifest-snapshot.json +253 -51
  9. package/manifest-snapshot.sha256 +1 -1
  10. package/manifest.json +325 -123
  11. package/package.json +1 -1
  12. package/sbom.cdx.json +28 -28
  13. package/scripts/build-indexes.js +10 -4
  14. package/scripts/sync-manifest-metadata.js +37 -11
package/manifest.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "exceptd-security",
3
- "version": "0.18.3",
3
+ "version": "0.18.5",
4
4
  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
5
5
  "homepage": "https://exceptd.com",
6
6
  "license": "Apache-2.0",
@@ -31,7 +31,9 @@
31
31
  ],
32
32
  "data_deps": [
33
33
  "cve-catalog.json",
34
- "exploit-availability.json"
34
+ "exploit-availability.json",
35
+ "d3fend-catalog.json",
36
+ "rfc-references.json"
35
37
  ],
36
38
  "atlas_refs": [],
37
39
  "attack_refs": [
@@ -44,7 +46,9 @@
44
46
  "PCI-DSS-4.0-6.3.3",
45
47
  "NIS2-Art21-patch-management",
46
48
  "NIST-800-53-SC-8",
47
- "CIS-Controls-v8-Control7"
49
+ "CIS-Controls-v8-Control7",
50
+ "UK-CAF-D1",
51
+ "AU-Essential-8-Patch"
48
52
  ],
49
53
  "rfc_refs": [
50
54
  "RFC-4301",
@@ -53,7 +57,7 @@
53
57
  ],
54
58
  "last_threat_review": "2026-05-15",
55
59
  "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
56
- "signed_at": "2026-06-14T13:48:50.059Z",
60
+ "signed_at": "2026-06-14T15:48:45.440Z",
57
61
  "cwe_refs": [
58
62
  "CWE-125",
59
63
  "CWE-362",
@@ -65,7 +69,9 @@
65
69
  "D3-ASLR",
66
70
  "D3-EAL",
67
71
  "D3-PHRA",
68
- "D3-PSEP"
72
+ "D3-PSEP",
73
+ "D3-PA",
74
+ "D3-SCP"
69
75
  ],
70
76
  "forward_watch": [
71
77
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12 or sooner via Patch Tuesday) — Windows 11 LPE improper access control by DEVCORE (Angelboy + TwinkleStar03); track MSRC advisory and KEV add",
@@ -93,7 +99,8 @@
93
99
  "data_deps": [
94
100
  "cve-catalog.json",
95
101
  "atlas-ttps.json",
96
- "framework-control-gaps.json"
102
+ "framework-control-gaps.json",
103
+ "d3fend-catalog.json"
97
104
  ],
98
105
  "atlas_refs": [
99
106
  "AML.T0043",
@@ -119,11 +126,14 @@
119
126
  "NIST-800-53-SI-3",
120
127
  "OWASP-LLM-Top-10-2025-LLM01",
121
128
  "OWASP-LLM-Top-10-2025-LLM02",
122
- "SOC2-CC6-logical-access"
129
+ "SOC2-CC6-logical-access",
130
+ "EU-AI-Act-Art-15",
131
+ "UK-CAF-A1",
132
+ "AU-Essential-8-App-Hardening"
123
133
  ],
124
134
  "last_threat_review": "2026-06-10",
125
135
  "signature": "WfqxU2x/feWgatYrCeO9PD3dIY0FAfs4nkVdQRac4fg5BDQPG/vhzhvYVN6Mg11oITACghbPOtZXvS37sACsCA==",
126
- "signed_at": "2026-06-14T13:48:50.061Z",
136
+ "signed_at": "2026-06-14T15:48:45.442Z",
127
137
  "cwe_refs": [
128
138
  "CWE-1039",
129
139
  "CWE-1426",
@@ -131,7 +141,10 @@
131
141
  ],
132
142
  "d3fend_refs": [
133
143
  "D3-IOPR",
134
- "D3-NTA"
144
+ "D3-NTA",
145
+ "D3-EAL",
146
+ "D3-FAPA",
147
+ "D3-CSPP"
135
148
  ],
136
149
  "forward_watch": [
137
150
  "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory",
@@ -164,7 +177,10 @@
164
177
  "data_deps": [
165
178
  "cve-catalog.json",
166
179
  "atlas-ttps.json",
167
- "framework-control-gaps.json"
180
+ "framework-control-gaps.json",
181
+ "d3fend-catalog.json",
182
+ "exploit-availability.json",
183
+ "rfc-references.json"
168
184
  ],
169
185
  "atlas_refs": [
170
186
  "AML.T0010",
@@ -183,7 +199,10 @@
183
199
  "NIST-800-53-SA-12",
184
200
  "OWASP-LLM-Top-10-2025-LLM06",
185
201
  "SOC2-CC9-vendor-management",
186
- "SWIFT-CSCF-v2026-1.1"
202
+ "SWIFT-CSCF-v2026-1.1",
203
+ "EU-AI-Act-Art-15",
204
+ "UK-CAF-A1",
205
+ "AU-Essential-8-App-Hardening"
187
206
  ],
188
207
  "rfc_refs": [
189
208
  "RFC-6749",
@@ -196,7 +215,7 @@
196
215
  ],
197
216
  "last_threat_review": "2026-06-10",
198
217
  "signature": "9bNOW4MzmUlFgkXH5tIZkq8YpzhMM+r8YVcNEM39kdEZwfRNG4Bj+Dgr7v4Qgp9D4q7hGNFpK0ywX+dPd3VWAg==",
199
- "signed_at": "2026-06-14T13:48:50.062Z",
218
+ "signed_at": "2026-06-14T15:48:45.442Z",
200
219
  "cwe_refs": [
201
220
  "CWE-22",
202
221
  "CWE-345",
@@ -212,7 +231,8 @@
212
231
  "D3-CSPP",
213
232
  "D3-EAL",
214
233
  "D3-EHB",
215
- "D3-MFA"
234
+ "D3-MFA",
235
+ "D3-CAA"
216
236
  ],
217
237
  "forward_watch": [
218
238
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; MCP-adjacent LLM proxy surface; track upstream patch and MCP trust advisory",
@@ -241,14 +261,15 @@
241
261
  "framework-control-gaps.json",
242
262
  "atlas-ttps.json",
243
263
  "cve-catalog.json",
244
- "global-frameworks.json"
264
+ "global-frameworks.json",
265
+ "exploit-availability.json"
245
266
  ],
246
267
  "atlas_refs": [],
247
268
  "attack_refs": [],
248
269
  "framework_gaps": [],
249
270
  "last_threat_review": "2026-06-10",
250
271
  "signature": "5A08+nAu5jwNQ1+vGbFgFAJA/kYD3oiaevhCxT4/2FeW++F070Pm4MD1+oXdv8R2DbtYr+7yXnCGM7UbUPR2AA==",
251
- "signed_at": "2026-06-14T13:48:50.062Z"
272
+ "signed_at": "2026-06-14T15:48:45.442Z"
252
273
  },
253
274
  {
254
275
  "name": "compliance-theater",
@@ -267,7 +288,8 @@
267
288
  "data_deps": [
268
289
  "framework-control-gaps.json",
269
290
  "cve-catalog.json",
270
- "exploit-availability.json"
291
+ "exploit-availability.json",
292
+ "atlas-ttps.json"
271
293
  ],
272
294
  "atlas_refs": [],
273
295
  "attack_refs": [],
@@ -279,7 +301,7 @@
279
301
  ],
280
302
  "last_threat_review": "2026-06-10",
281
303
  "signature": "RCgbI0sMNTKAscXUtrVU25u7OuE64uQvO5JKsB8vIJFWguvT6nZyD7euKuIxIzYhLTyHBiD7Rhp70btlK+JkCg==",
282
- "signed_at": "2026-06-14T13:48:50.063Z"
304
+ "signed_at": "2026-06-14T15:48:45.443Z"
283
305
  },
284
306
  {
285
307
  "name": "exploit-scoring",
@@ -298,7 +320,9 @@
298
320
  ],
299
321
  "data_deps": [
300
322
  "cve-catalog.json",
301
- "exploit-availability.json"
323
+ "exploit-availability.json",
324
+ "atlas-ttps.json",
325
+ "zeroday-lessons.json"
302
326
  ],
303
327
  "atlas_refs": [],
304
328
  "attack_refs": [],
@@ -308,7 +332,7 @@
308
332
  ],
309
333
  "last_threat_review": "2026-06-10",
310
334
  "signature": "JJrs+B22/hYxvdYs+abmoire5PbQXPb2uVYyjInZ3UbT8gEjs/5SyfGKx7z86jbtvB3ItApQVAx1AuseIgdyAQ==",
311
- "signed_at": "2026-06-14T13:48:50.064Z"
335
+ "signed_at": "2026-06-14T15:48:45.444Z"
312
336
  },
313
337
  {
314
338
  "name": "rag-pipeline-security",
@@ -326,7 +350,9 @@
326
350
  ],
327
351
  "data_deps": [
328
352
  "atlas-ttps.json",
329
- "framework-control-gaps.json"
353
+ "framework-control-gaps.json",
354
+ "d3fend-catalog.json",
355
+ "exploit-availability.json"
330
356
  ],
331
357
  "atlas_refs": [
332
358
  "AML.T0020",
@@ -341,11 +367,14 @@
341
367
  "ISO-27001-2022-A.8.28",
342
368
  "NIST-800-53-SI-12",
343
369
  "NIST-AI-RMF-MEASURE-2.5",
344
- "OWASP-LLM-Top-10-2025-LLM08"
370
+ "OWASP-LLM-Top-10-2025-LLM08",
371
+ "EU-AI-Act-Art-15",
372
+ "UK-CAF-B2",
373
+ "AU-Essential-8-App-Hardening"
345
374
  ],
346
375
  "last_threat_review": "2026-06-10",
347
376
  "signature": "Z6WbTqG98bQVRd6+kXDb6xIEe0ZryAeGxVSuKKxdK1PoZqew7NJcMsa6sJVSq+0r7KMsFwfTEdKorp6UDdhpCA==",
348
- "signed_at": "2026-06-14T13:48:50.064Z",
377
+ "signed_at": "2026-06-14T15:48:45.444Z",
349
378
  "cwe_refs": [
350
379
  "CWE-1395",
351
380
  "CWE-1426"
@@ -353,7 +382,9 @@
353
382
  "d3fend_refs": [
354
383
  "D3-CSPP",
355
384
  "D3-IOPR",
356
- "D3-NTA"
385
+ "D3-NTA",
386
+ "D3-FCR",
387
+ "D3-FAPA"
357
388
  ],
358
389
  "forward_watch": [
359
390
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Chroma vector DB CWE-190 + CWE-362 chain by haehae; impacts RAG vector store integrity (integer overflow + race condition); track patch and downstream RAG pipeline advisory"
@@ -378,7 +409,9 @@
378
409
  "data_deps": [
379
410
  "atlas-ttps.json",
380
411
  "cve-catalog.json",
381
- "framework-control-gaps.json"
412
+ "framework-control-gaps.json",
413
+ "d3fend-catalog.json",
414
+ "rfc-references.json"
382
415
  ],
383
416
  "atlas_refs": [
384
417
  "AML.T0096",
@@ -393,7 +426,10 @@
393
426
  "NIST-800-53-SI-3",
394
427
  "NIST-800-53-SC-7",
395
428
  "ISO-27001-2022-A.8.16",
396
- "SOC2-CC7-anomaly-detection"
429
+ "SOC2-CC7-anomaly-detection",
430
+ "NIS2-Art21-incident-handling",
431
+ "UK-CAF-C1",
432
+ "AU-Essential-8-App-Hardening"
397
433
  ],
398
434
  "rfc_refs": [
399
435
  "RFC-8446",
@@ -405,7 +441,7 @@
405
441
  ],
406
442
  "last_threat_review": "2026-06-10",
407
443
  "signature": "DLKcrgon+MZrqmivlFLBH4vlzZbJSW1531RsYDm9/KdW2CgcUUHwNMSzAfU1mAsFwFkAHjy/a8e1FbS9msTvDA==",
408
- "signed_at": "2026-06-14T13:48:50.064Z",
444
+ "signed_at": "2026-06-14T15:48:45.444Z",
409
445
  "cwe_refs": [
410
446
  "CWE-918"
411
447
  ],
@@ -436,14 +472,17 @@
436
472
  ],
437
473
  "data_deps": [
438
474
  "framework-control-gaps.json",
439
- "global-frameworks.json"
475
+ "global-frameworks.json",
476
+ "atlas-ttps.json",
477
+ "cve-catalog.json",
478
+ "exploit-availability.json"
440
479
  ],
441
480
  "atlas_refs": [],
442
481
  "attack_refs": [],
443
482
  "framework_gaps": [],
444
483
  "last_threat_review": "2026-06-10",
445
484
  "signature": "eWCOD+mR1c6B8vKDBot8y8UkQrKPCIEBHU3JRQET9xZnYGx8hrOyeRUElcKqCO5aG/2LISs9Atg1H+ehWDNbCw==",
446
- "signed_at": "2026-06-14T13:48:50.065Z",
485
+ "signed_at": "2026-06-14T15:48:45.445Z",
447
486
  "cwe_refs": [
448
487
  "CWE-1188"
449
488
  ],
@@ -470,14 +509,15 @@
470
509
  "data_deps": [
471
510
  "atlas-ttps.json",
472
511
  "cve-catalog.json",
473
- "framework-control-gaps.json"
512
+ "framework-control-gaps.json",
513
+ "global-frameworks.json"
474
514
  ],
475
515
  "atlas_refs": [],
476
516
  "attack_refs": [],
477
517
  "framework_gaps": [],
478
518
  "last_threat_review": "2026-06-10",
479
519
  "signature": "kZca725/+BFr1mpxL29+cGzjqsiYhChWScf7VjU6vCTBZrmCps6W9gYYjf4lVORXaM4DAg3UVBOXyhpTst0rAw==",
480
- "signed_at": "2026-06-14T13:48:50.065Z",
520
+ "signed_at": "2026-06-14T15:48:45.445Z",
481
521
  "forward_watch": [
482
522
  "New AI attack classes as ATLAS v6 publishes",
483
523
  "Post-quantum adversary capability timeline",
@@ -509,14 +549,15 @@
509
549
  "data_deps": [
510
550
  "global-frameworks.json",
511
551
  "framework-control-gaps.json",
512
- "atlas-ttps.json"
552
+ "atlas-ttps.json",
553
+ "exploit-availability.json"
513
554
  ],
514
555
  "atlas_refs": [],
515
556
  "attack_refs": [],
516
557
  "framework_gaps": [],
517
558
  "last_threat_review": "2026-05-01",
518
559
  "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
519
- "signed_at": "2026-06-14T13:48:50.066Z"
560
+ "signed_at": "2026-06-14T15:48:45.445Z"
520
561
  },
521
562
  {
522
563
  "name": "zeroday-gap-learn",
@@ -543,7 +584,7 @@
543
584
  "framework_gaps": [],
544
585
  "last_threat_review": "2026-06-10",
545
586
  "signature": "NVBY4I5a+v2/nUeCYcy3LLVKk3Tg9gmz+sCKyvnf8t2fXMNSIGtoy+P8K4Gfos1rGzRRMaU01V7L4kh/IQ8UBQ==",
546
- "signed_at": "2026-06-14T13:48:50.066Z",
587
+ "signed_at": "2026-06-14T15:48:45.446Z",
547
588
  "forward_watch": [
548
589
  "New CISA KEV entries",
549
590
  "New ATLAS TTP additions in each ATLAS release",
@@ -574,7 +615,11 @@
574
615
  ],
575
616
  "data_deps": [
576
617
  "cve-catalog.json",
577
- "framework-control-gaps.json"
618
+ "framework-control-gaps.json",
619
+ "atlas-ttps.json",
620
+ "exploit-availability.json",
621
+ "global-frameworks.json",
622
+ "rfc-references.json"
578
623
  ],
579
624
  "atlas_refs": [],
580
625
  "attack_refs": [],
@@ -607,7 +652,7 @@
607
652
  ],
608
653
  "last_threat_review": "2026-06-10",
609
654
  "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
610
- "signed_at": "2026-06-14T13:48:50.067Z",
655
+ "signed_at": "2026-06-14T15:48:45.446Z",
611
656
  "cwe_refs": [
612
657
  "CWE-327"
613
658
  ],
@@ -639,7 +684,9 @@
639
684
  "framework-control-gaps.json",
640
685
  "global-frameworks.json",
641
686
  "zeroday-lessons.json",
642
- "exploit-availability.json"
687
+ "exploit-availability.json",
688
+ "d3fend-catalog.json",
689
+ "rfc-references.json"
643
690
  ],
644
691
  "atlas_refs": [],
645
692
  "attack_refs": [],
@@ -655,7 +702,7 @@
655
702
  ],
656
703
  "last_threat_review": "2026-06-10",
657
704
  "signature": "QsJMwvnUJXHwoBPJ4BiUx3FO9giXfos/sMbx5tyO83AJ2JxdVskeC6g/WDfO+rVkWNXRgWi4h1eSYz6T8/tpAg==",
658
- "signed_at": "2026-06-14T13:48:50.067Z"
705
+ "signed_at": "2026-06-14T15:48:45.446Z"
659
706
  },
660
707
  {
661
708
  "name": "security-maturity-tiers",
@@ -679,7 +726,8 @@
679
726
  "data_deps": [
680
727
  "cve-catalog.json",
681
728
  "framework-control-gaps.json",
682
- "global-frameworks.json"
729
+ "global-frameworks.json",
730
+ "atlas-ttps.json"
683
731
  ],
684
732
  "atlas_refs": [],
685
733
  "attack_refs": [],
@@ -692,7 +740,7 @@
692
740
  ],
693
741
  "last_threat_review": "2026-05-01",
694
742
  "signature": "8KbLVVPI1QgYa+HAnEYvKf1cXnxQ3zsncqTGrAOrBP4rwUeZsxJm8KyFCwI0XytnZG35PZ830BFlG/okPW3sBQ==",
695
- "signed_at": "2026-06-14T13:48:50.067Z",
743
+ "signed_at": "2026-06-14T15:48:45.447Z",
696
744
  "cwe_refs": [
697
745
  "CWE-1188"
698
746
  ]
@@ -720,14 +768,15 @@
720
768
  "framework-control-gaps.json",
721
769
  "zeroday-lessons.json",
722
770
  "exploit-availability.json",
723
- "global-frameworks.json"
771
+ "global-frameworks.json",
772
+ "d3fend-catalog.json"
724
773
  ],
725
774
  "atlas_refs": [],
726
775
  "attack_refs": [],
727
776
  "framework_gaps": [],
728
777
  "last_threat_review": "2026-05-11",
729
778
  "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
730
- "signed_at": "2026-06-14T13:48:50.068Z"
779
+ "signed_at": "2026-06-14T15:48:45.447Z"
731
780
  },
732
781
  {
733
782
  "name": "attack-surface-pentest",
@@ -752,7 +801,8 @@
752
801
  "atlas-ttps.json",
753
802
  "framework-control-gaps.json",
754
803
  "cwe-catalog.json",
755
- "d3fend-catalog.json"
804
+ "d3fend-catalog.json",
805
+ "exploit-availability.json"
756
806
  ],
757
807
  "atlas_refs": [
758
808
  "AML.T0043",
@@ -769,7 +819,10 @@
769
819
  "NIST-800-115",
770
820
  "OWASP-Pen-Testing-Guide-v5",
771
821
  "PTES-Pre-engagement",
772
- "NIS2-Art21-patch-management"
822
+ "NIS2-Art21-patch-management",
823
+ "ISO-27001-2022-A.8.8",
824
+ "UK-CAF-A1",
825
+ "AU-Essential-8-App-Hardening"
773
826
  ],
774
827
  "rfc_refs": [],
775
828
  "cwe_refs": [
@@ -799,7 +852,7 @@
799
852
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
800
853
  ],
801
854
  "signature": "ZnFi+Rk4CWrjFEVU4hC6Q66UbDmndNL/ICLWQNA1TQYFGSTnng+nboM4tfi6h0yMbbDj7dOXYqqeHNK+M5ZiBA==",
802
- "signed_at": "2026-06-14T13:48:50.068Z"
855
+ "signed_at": "2026-06-14T15:48:45.448Z"
803
856
  },
804
857
  {
805
858
  "name": "fuzz-testing-strategy",
@@ -824,7 +877,8 @@
824
877
  "atlas-ttps.json",
825
878
  "framework-control-gaps.json",
826
879
  "cwe-catalog.json",
827
- "d3fend-catalog.json"
880
+ "d3fend-catalog.json",
881
+ "zeroday-lessons.json"
828
882
  ],
829
883
  "atlas_refs": [
830
884
  "AML.T0043"
@@ -859,7 +913,7 @@
859
913
  "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
860
914
  ],
861
915
  "signature": "45ICz7vcnmHYE1+RIDv8wQjScKj6p8hqJQ5m6I0tDdKVnGdMXCYIgZnYqFJgHBDXYAXlGx7D7UxhFz6WOCDqAQ==",
862
- "signed_at": "2026-06-14T13:48:50.068Z"
916
+ "signed_at": "2026-06-14T15:48:45.448Z"
863
917
  },
864
918
  {
865
919
  "name": "dlp-gap-analysis",
@@ -908,7 +962,10 @@
908
962
  "ISO-IEC-42001-2023-clause-6.1.2",
909
963
  "HIPAA-Security-Rule-164.312(a)(1)",
910
964
  "SOC2-CC7-anomaly-detection",
911
- "NIST-800-53-SC-28"
965
+ "NIST-800-53-SC-28",
966
+ "NIS2-Art21-incident-handling",
967
+ "UK-CAF-C1",
968
+ "AU-Essential-8-App-Hardening"
912
969
  ],
913
970
  "rfc_refs": [
914
971
  "RFC-8446",
@@ -934,7 +991,7 @@
934
991
  "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
935
992
  ],
936
993
  "signature": "k6A7QcFEzgGXYWftt/elhQe7kU4F67c0ol3a8DZfj1XW4UrH99SLhPHr6ih3R3EYCl/Ey/zXt/x3a9fDT3RmAw==",
937
- "signed_at": "2026-06-14T13:48:50.069Z"
994
+ "signed_at": "2026-06-14T15:48:45.448Z"
938
995
  },
939
996
  {
940
997
  "name": "supply-chain-integrity",
@@ -963,7 +1020,9 @@
963
1020
  "framework-control-gaps.json",
964
1021
  "rfc-references.json",
965
1022
  "cwe-catalog.json",
966
- "d3fend-catalog.json"
1023
+ "d3fend-catalog.json",
1024
+ "exploit-availability.json",
1025
+ "global-frameworks.json"
967
1026
  ],
968
1027
  "atlas_refs": [
969
1028
  "AML.T0010",
@@ -984,7 +1043,10 @@
984
1043
  "HITRUST-CSF-v11.4-09.l",
985
1044
  "SWIFT-CSCF-v2026-1.1",
986
1045
  "FedRAMP-Rev5-Moderate",
987
- "CMMC-2.0-Level-2"
1046
+ "CMMC-2.0-Level-2",
1047
+ "NIS2-Art21-incident-handling",
1048
+ "UK-CAF-A1",
1049
+ "AU-Essential-8-App-Hardening"
988
1050
  ],
989
1051
  "rfc_refs": [
990
1052
  "RFC-8032"
@@ -1013,7 +1075,7 @@
1013
1075
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
1014
1076
  ],
1015
1077
  "signature": "5shKqNcLC8Obt0EdvKnck8OwWIuRMgZuuZd12pvWqJIltsYMyTrw2M+lgbQfqg3x2KO6qsJljGAhTew5jM58DQ==",
1016
- "signed_at": "2026-06-14T13:48:50.069Z"
1078
+ "signed_at": "2026-06-14T15:48:45.449Z"
1017
1079
  },
1018
1080
  {
1019
1081
  "name": "defensive-countermeasure-mapping",
@@ -1070,7 +1132,7 @@
1070
1132
  ],
1071
1133
  "last_threat_review": "2026-06-10",
1072
1134
  "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
1073
- "signed_at": "2026-06-14T13:48:50.069Z"
1135
+ "signed_at": "2026-06-14T15:48:45.449Z"
1074
1136
  },
1075
1137
  {
1076
1138
  "name": "identity-assurance",
@@ -1101,7 +1163,8 @@
1101
1163
  "framework-control-gaps.json",
1102
1164
  "cwe-catalog.json",
1103
1165
  "d3fend-catalog.json",
1104
- "rfc-references.json"
1166
+ "rfc-references.json",
1167
+ "exploit-availability.json"
1105
1168
  ],
1106
1169
  "atlas_refs": [
1107
1170
  "AML.T0051"
@@ -1116,7 +1179,10 @@
1116
1179
  "NIST-800-53-AC-2",
1117
1180
  "ISO-27001-2022-A.8.30",
1118
1181
  "SOC2-CC6-logical-access",
1119
- "PSD2-RTS-SCA"
1182
+ "PSD2-RTS-SCA",
1183
+ "NIS2-Art21-incident-handling",
1184
+ "UK-CAF-B2",
1185
+ "AU-Essential-8-MFA"
1120
1186
  ],
1121
1187
  "rfc_refs": [
1122
1188
  "RFC-7519",
@@ -1134,10 +1200,13 @@
1134
1200
  "CWE-862",
1135
1201
  "CWE-863"
1136
1202
  ],
1137
- "d3fend_refs": [],
1203
+ "d3fend_refs": [
1204
+ "D3-MFA",
1205
+ "D3-CSPP"
1206
+ ],
1138
1207
  "last_threat_review": "2026-05-11",
1139
1208
  "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
1140
- "signed_at": "2026-06-14T13:48:50.070Z"
1209
+ "signed_at": "2026-06-14T15:48:45.449Z"
1141
1210
  },
1142
1211
  {
1143
1212
  "name": "ot-ics-security",
@@ -1181,7 +1250,10 @@
1181
1250
  "NIST-800-82r3",
1182
1251
  "IEC-62443-3-3",
1183
1252
  "NERC-CIP-007-6-R4",
1184
- "NIS2-Art21-patch-management"
1253
+ "NIS2-Art21-patch-management",
1254
+ "ISO-27001-2022-A.8.8",
1255
+ "UK-CAF-B2",
1256
+ "AU-Essential-8-App-Hardening"
1185
1257
  ],
1186
1258
  "rfc_refs": [],
1187
1259
  "cwe_refs": [
@@ -1193,7 +1265,7 @@
1193
1265
  "d3fend_refs": [],
1194
1266
  "last_threat_review": "2026-06-10",
1195
1267
  "signature": "afJ00EDXgARQJrbRqN6xe1+E/kbHF7O2fxQFVvrLLXdrKfK86RK/oJU1AwpxX6mclX9f+5ivy6FvFIuRMA4dBQ==",
1196
- "signed_at": "2026-06-14T13:48:50.070Z"
1268
+ "signed_at": "2026-06-14T15:48:45.450Z"
1197
1269
  },
1198
1270
  {
1199
1271
  "name": "coordinated-vuln-disclosure",
@@ -1228,9 +1300,17 @@
1228
1300
  "framework_gaps": [
1229
1301
  "NIST-800-218-SSDF",
1230
1302
  "ISO-27001-2022-A.8.8",
1231
- "SOC2-CC9-vendor-management"
1303
+ "SOC2-CC9-vendor-management",
1304
+ "NIS2-Art21-incident-handling",
1305
+ "UK-CAF-D1",
1306
+ "AU-Essential-8-Patch"
1307
+ ],
1308
+ "rfc_refs": [
1309
+ "ISO-29147",
1310
+ "ISO-30111",
1311
+ "RFC-9116",
1312
+ "CSAF-2.0"
1232
1313
  ],
1233
- "rfc_refs": [],
1234
1314
  "cwe_refs": [
1235
1315
  "CWE-1357"
1236
1316
  ],
@@ -1245,7 +1325,7 @@
1245
1325
  "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
1246
1326
  ],
1247
1327
  "signature": "VzivMW82mRrG9+07ZX8sj4j9O9YjE/m07m1UHgSwEgex+FLaVPvIj3y1Vk6qeFOvDURmtVaztWlpSlk7iSn0DA==",
1248
- "signed_at": "2026-06-14T13:48:50.070Z"
1328
+ "signed_at": "2026-06-14T15:48:45.450Z"
1249
1329
  },
1250
1330
  {
1251
1331
  "name": "threat-modeling-methodology",
@@ -1272,7 +1352,8 @@
1272
1352
  "framework-control-gaps.json",
1273
1353
  "cve-catalog.json",
1274
1354
  "cwe-catalog.json",
1275
- "d3fend-catalog.json"
1355
+ "d3fend-catalog.json",
1356
+ "zeroday-lessons.json"
1276
1357
  ],
1277
1358
  "atlas_refs": [],
1278
1359
  "attack_refs": [],
@@ -1280,7 +1361,10 @@
1280
1361
  "ISO-27001-2022-A.8.28",
1281
1362
  "ISO-IEC-23894-2023-clause-7",
1282
1363
  "ISO-IEC-42001-2023-clause-6.1.2",
1283
- "NIST-800-218-SSDF"
1364
+ "NIST-800-218-SSDF",
1365
+ "NIS2-Art21-incident-handling",
1366
+ "UK-CAF-A1",
1367
+ "AU-Essential-8-App-Hardening"
1284
1368
  ],
1285
1369
  "rfc_refs": [],
1286
1370
  "cwe_refs": [],
@@ -1295,7 +1379,7 @@
1295
1379
  "PASTA v2 updates incorporating AI/ML application threats"
1296
1380
  ],
1297
1381
  "signature": "Fk5LzzeS/bH5SQJNySgZqSdeQf1udwdRs3FVLwig5kuqyyKkuIJcF4HW+xHF/1e66HR+gjgRUoqWZGsv58lLAg==",
1298
- "signed_at": "2026-06-14T13:48:50.071Z"
1382
+ "signed_at": "2026-06-14T15:48:45.450Z"
1299
1383
  },
1300
1384
  {
1301
1385
  "name": "webapp-security",
@@ -1339,7 +1423,10 @@
1339
1423
  "OWASP-ASVS-v5.0-V14",
1340
1424
  "OWASP-LLM-Top-10-2025-LLM01",
1341
1425
  "NIST-800-218-SSDF",
1342
- "ISO-27001-2022-A.8.28"
1426
+ "ISO-27001-2022-A.8.28",
1427
+ "NIS2-Art21-incident-handling",
1428
+ "UK-CAF-B2",
1429
+ "AU-Essential-8-App-Hardening"
1343
1430
  ],
1344
1431
  "rfc_refs": [
1345
1432
  "RFC-8446",
@@ -1366,10 +1453,16 @@
1366
1453
  "CWE-918",
1367
1454
  "CWE-1188"
1368
1455
  ],
1369
- "d3fend_refs": [],
1456
+ "d3fend_refs": [
1457
+ "D3-IOPR",
1458
+ "D3-NTA",
1459
+ "D3-CSPP",
1460
+ "D3-EAL",
1461
+ "D3-MFA"
1462
+ ],
1370
1463
  "last_threat_review": "2026-06-10",
1371
1464
  "signature": "1skHJsPPOIXLQdU5MGHirP/Q07aCYTirtDmfWDO7ZNuto58NlCttW5ZjCpyh37vASlMljIZx0/R+PIl2PfwTBw==",
1372
- "signed_at": "2026-06-14T13:48:50.071Z",
1465
+ "signed_at": "2026-06-14T15:48:45.451Z",
1373
1466
  "forward_watch": [
1374
1467
  "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
1375
1468
  ]
@@ -1400,7 +1493,9 @@
1400
1493
  "global-frameworks.json",
1401
1494
  "cwe-catalog.json",
1402
1495
  "d3fend-catalog.json",
1403
- "zeroday-lessons.json"
1496
+ "zeroday-lessons.json",
1497
+ "cve-catalog.json",
1498
+ "exploit-availability.json"
1404
1499
  ],
1405
1500
  "atlas_refs": [
1406
1501
  "AML.T0051",
@@ -1412,17 +1507,22 @@
1412
1507
  "ISO-IEC-42001-2023-clause-6.1.2",
1413
1508
  "ISO-IEC-23894-2023-clause-7",
1414
1509
  "NIST-AI-RMF-MEASURE-2.5",
1415
- "OWASP-LLM-Top-10-2025-LLM01"
1510
+ "OWASP-LLM-Top-10-2025-LLM01",
1511
+ "EU-AI-Act-Art-15",
1512
+ "UK-CAF-A1",
1513
+ "AU-Essential-8-App-Hardening"
1416
1514
  ],
1417
1515
  "rfc_refs": [],
1418
1516
  "cwe_refs": [
1419
1517
  "CWE-1426",
1420
1518
  "CWE-1039"
1421
1519
  ],
1422
- "d3fend_refs": [],
1520
+ "d3fend_refs": [
1521
+ "D3-IOPR"
1522
+ ],
1423
1523
  "last_threat_review": "2026-05-15",
1424
1524
  "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
1425
- "signed_at": "2026-06-14T13:48:50.072Z"
1525
+ "signed_at": "2026-06-14T15:48:45.451Z"
1426
1526
  },
1427
1527
  {
1428
1528
  "name": "sector-healthcare",
@@ -1467,7 +1567,10 @@
1467
1567
  "HIPAA-Security-Rule-164.312(a)(1)",
1468
1568
  "HITRUST-CSF-v11.4-09.l",
1469
1569
  "ISO-27001-2022-A.8.30",
1470
- "NIST-800-53-AC-2"
1570
+ "NIST-800-53-AC-2",
1571
+ "NIS2-Art21-incident-handling",
1572
+ "UK-CAF-D1",
1573
+ "AU-Essential-8-Backup"
1471
1574
  ],
1472
1575
  "rfc_refs": [
1473
1576
  "RFC-7519",
@@ -1479,10 +1582,14 @@
1479
1582
  "CWE-862",
1480
1583
  "CWE-1426"
1481
1584
  ],
1482
- "d3fend_refs": [],
1585
+ "d3fend_refs": [
1586
+ "D3-IOPR",
1587
+ "D3-CSPP",
1588
+ "D3-MFA"
1589
+ ],
1483
1590
  "last_threat_review": "2026-06-10",
1484
1591
  "signature": "yyAGG3nUC6/XWQGRF2ufzILfiJitMFczqWNY83lZShCgYSxfFCul0UsICClOc7Xjw76052uydm8kLH9gIzhsAg==",
1485
- "signed_at": "2026-06-14T13:48:50.072Z"
1592
+ "signed_at": "2026-06-14T15:48:45.452Z"
1486
1593
  },
1487
1594
  {
1488
1595
  "name": "sector-financial",
@@ -1531,7 +1638,10 @@
1531
1638
  "PSD2-RTS-SCA",
1532
1639
  "SWIFT-CSCF-v2026-1.1",
1533
1640
  "NIST-800-53-AC-2",
1534
- "SOC2-CC6-logical-access"
1641
+ "SOC2-CC6-logical-access",
1642
+ "NIS2-Art21-incident-handling",
1643
+ "UK-CAF-A1",
1644
+ "AU-Essential-8-MFA"
1535
1645
  ],
1536
1646
  "rfc_refs": [
1537
1647
  "RFC-8446",
@@ -1546,7 +1656,12 @@
1546
1656
  "CWE-798",
1547
1657
  "CWE-352"
1548
1658
  ],
1549
- "d3fend_refs": [],
1659
+ "d3fend_refs": [
1660
+ "D3-MFA",
1661
+ "D3-CBAN",
1662
+ "D3-NTA",
1663
+ "D3-IOPR"
1664
+ ],
1550
1665
  "last_threat_review": "2026-06-10",
1551
1666
  "forward_watch": [
1552
1667
  "PSD3 + PSR (Payment Services Regulation) trilogue and final adoption (expected 2026-2027); track agent-initiated payment treatment in final text",
@@ -1563,7 +1678,7 @@
1563
1678
  "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
1564
1679
  ],
1565
1680
  "signature": "/+df91Qhl1TIxEAqzgqB7+YJ6mneX6Dif+h6RaCbxOLGE6KRTFst1Q/Fu5SStt8Zx5JI62bkQ2BBrNOKfUlPBg==",
1566
- "signed_at": "2026-06-14T13:48:50.073Z"
1681
+ "signed_at": "2026-06-14T15:48:45.452Z"
1567
1682
  },
1568
1683
  {
1569
1684
  "name": "sector-federal-government",
@@ -1594,7 +1709,8 @@
1594
1709
  "framework-control-gaps.json",
1595
1710
  "global-frameworks.json",
1596
1711
  "cwe-catalog.json",
1597
- "d3fend-catalog.json"
1712
+ "d3fend-catalog.json",
1713
+ "exploit-availability.json"
1598
1714
  ],
1599
1715
  "atlas_refs": [],
1600
1716
  "attack_refs": [
@@ -1606,7 +1722,10 @@
1606
1722
  "FedRAMP-Rev5-Moderate",
1607
1723
  "CMMC-2.0-Level-2",
1608
1724
  "NIST-800-218-SSDF",
1609
- "SLSA-v1.0-Build-L3"
1725
+ "SLSA-v1.0-Build-L3",
1726
+ "NIS2-Art21-incident-handling",
1727
+ "UK-CAF-A1",
1728
+ "AU-Essential-8-App-Hardening"
1610
1729
  ],
1611
1730
  "rfc_refs": [
1612
1731
  "RFC-8032",
@@ -1617,7 +1736,11 @@
1617
1736
  "CWE-1395",
1618
1737
  "CWE-829"
1619
1738
  ],
1620
- "d3fend_refs": [],
1739
+ "d3fend_refs": [
1740
+ "D3-EAL",
1741
+ "D3-EHB",
1742
+ "D3-CBAN"
1743
+ ],
1621
1744
  "last_threat_review": "2026-06-10",
1622
1745
  "forward_watch": [
1623
1746
  "CMMC 2.0 phased rollout milestones through 2028 — Phase 1 (self-assessment) effective Dec 2024, Phase 2 (C3PAO assessments) ramping in 2025-2026, Phase 3 (DIBCAC-level assessments) and Phase 4 (full enforcement in all contracts) push into 2028",
@@ -1632,7 +1755,7 @@
1632
1755
  "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
1633
1756
  ],
1634
1757
  "signature": "k6MAPS8HJivu0DNwC1azPvyKeig2xLGz/hcqYd8T+s5GvIypPGfkeYRRKmdqMgHUe24f7bQeRZ7AxcQ9Bi6SCg==",
1635
- "signed_at": "2026-06-14T13:48:50.073Z"
1758
+ "signed_at": "2026-06-14T15:48:45.453Z"
1636
1759
  },
1637
1760
  {
1638
1761
  "name": "sector-energy",
@@ -1675,7 +1798,10 @@
1675
1798
  "NERC-CIP-007-6-R4",
1676
1799
  "NIST-800-82r3",
1677
1800
  "IEC-62443-3-3",
1678
- "NIS2-Art21-patch-management"
1801
+ "NIS2-Art21-patch-management",
1802
+ "ISO-27001-2022-A.8.8",
1803
+ "UK-CAF-D1",
1804
+ "AU-Essential-8-Backup"
1679
1805
  ],
1680
1806
  "rfc_refs": [],
1681
1807
  "cwe_refs": [
@@ -1684,7 +1810,13 @@
1684
1810
  "CWE-306",
1685
1811
  "CWE-1037"
1686
1812
  ],
1687
- "d3fend_refs": [],
1813
+ "d3fend_refs": [
1814
+ "D3-NI",
1815
+ "D3-NTPM",
1816
+ "D3-NTA",
1817
+ "D3-EAL",
1818
+ "D3-PSEP"
1819
+ ],
1688
1820
  "last_threat_review": "2026-06-10",
1689
1821
  "forward_watch": [
1690
1822
  "NERC CIP v7 final FERC order (anticipated 2026–2027) — additions for low-impact BES Cyber Systems, supply chain, and INSM (internal network security monitoring)",
@@ -1697,7 +1829,7 @@
1697
1829
  "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
1698
1830
  ],
1699
1831
  "signature": "IYKXn009jfhpKdQKiGB4xb7VgxsJXa6PZawoguP42khU6S/TTemp/YsK1YQCUyabE+2biElL/PP1Hi8zCkSSBw==",
1700
- "signed_at": "2026-06-14T13:48:50.073Z"
1832
+ "signed_at": "2026-06-14T15:48:45.453Z"
1701
1833
  },
1702
1834
  {
1703
1835
  "name": "sector-telecom",
@@ -1783,7 +1915,7 @@
1783
1915
  "O-RAN SFG / WG11 security specifications"
1784
1916
  ],
1785
1917
  "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
1786
- "signed_at": "2026-06-14T13:48:50.074Z"
1918
+ "signed_at": "2026-06-14T15:48:45.453Z"
1787
1919
  },
1788
1920
  {
1789
1921
  "name": "api-security",
@@ -1812,7 +1944,8 @@
1812
1944
  "framework-control-gaps.json",
1813
1945
  "cwe-catalog.json",
1814
1946
  "d3fend-catalog.json",
1815
- "rfc-references.json"
1947
+ "rfc-references.json",
1948
+ "attack-techniques.json"
1816
1949
  ],
1817
1950
  "atlas_refs": [
1818
1951
  "AML.T0096",
@@ -1827,7 +1960,10 @@
1827
1960
  "OWASP-ASVS-v5.0-V14",
1828
1961
  "NIST-800-218-SSDF",
1829
1962
  "ISO-27001-2022-A.8.28",
1830
- "NIST-800-53-AC-2"
1963
+ "NIST-800-53-AC-2",
1964
+ "NIS2-Art21-incident-handling",
1965
+ "UK-CAF-B2",
1966
+ "AU-Essential-8-App-Hardening"
1831
1967
  ],
1832
1968
  "rfc_refs": [
1833
1969
  "RFC-8446",
@@ -1849,10 +1985,16 @@
1849
1985
  "CWE-77",
1850
1986
  "CWE-1188"
1851
1987
  ],
1852
- "d3fend_refs": [],
1988
+ "d3fend_refs": [
1989
+ "D3-IOPR",
1990
+ "D3-NTA",
1991
+ "D3-CSPP",
1992
+ "D3-MFA",
1993
+ "D3-CBAN"
1994
+ ],
1853
1995
  "last_threat_review": "2026-06-10",
1854
1996
  "signature": "HUjhPGpZeZeVi1nzBIsEAYh18x5ltlIXnt1yQ5YKz+jC2Dvxw7vV/Clx1/1gDBLAuBvRW9wcNtDr4c0RxhfGDQ==",
1855
- "signed_at": "2026-06-14T13:48:50.074Z",
1997
+ "signed_at": "2026-06-14T15:48:45.454Z",
1856
1998
  "forward_watch": [
1857
1999
  "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
1858
2000
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1903,7 +2045,10 @@
1903
2045
  "NIST-800-53-CM-7",
1904
2046
  "ISO-27001-2022-A.8.30",
1905
2047
  "SOC2-CC9-vendor-management",
1906
- "FedRAMP-Rev5-Moderate"
2048
+ "FedRAMP-Rev5-Moderate",
2049
+ "NIS2-Art21-incident-handling",
2050
+ "UK-CAF-B2",
2051
+ "AU-Essential-8-MFA"
1907
2052
  ],
1908
2053
  "rfc_refs": [
1909
2054
  "RFC-8446",
@@ -1919,7 +2064,13 @@
1919
2064
  "CWE-1188",
1920
2065
  "CWE-798"
1921
2066
  ],
1922
- "d3fend_refs": [],
2067
+ "d3fend_refs": [
2068
+ "D3-NTA",
2069
+ "D3-NTPM",
2070
+ "D3-EAL",
2071
+ "D3-IOPR",
2072
+ "D3-CBAN"
2073
+ ],
1923
2074
  "last_threat_review": "2026-06-10",
1924
2075
  "forward_watch": [
1925
2076
  "CSA CCM v5 (in development) for AI-workload-aware control objectives and shared-responsibility refinement on managed AI services (Bedrock, Azure OpenAI, Vertex)",
@@ -1938,7 +2089,7 @@
1938
2089
  "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
1939
2090
  ],
1940
2091
  "signature": "xa1kr/92/0fBds7LVtRy9aCM2tQRWAfNSFoC6ygbOU7QjamUo8Wt2h2n9W+nZT34STN3woYhXqtfmm8NSjXdBQ==",
1941
- "signed_at": "2026-06-14T13:48:50.074Z"
2092
+ "signed_at": "2026-06-14T15:48:45.454Z"
1942
2093
  },
1943
2094
  {
1944
2095
  "name": "container-runtime-security",
@@ -1984,7 +2135,10 @@
1984
2135
  "framework_gaps": [
1985
2136
  "NIST-800-53-CM-7",
1986
2137
  "ISO-27001-2022-A.8.28",
1987
- "SLSA-v1.0-Build-L3"
2138
+ "SLSA-v1.0-Build-L3",
2139
+ "NIS2-Art21-incident-handling",
2140
+ "UK-CAF-B2",
2141
+ "AU-Essential-8-App-Hardening"
1988
2142
  ],
1989
2143
  "rfc_refs": [
1990
2144
  "RFC-8446",
@@ -1997,10 +2151,17 @@
1997
2151
  "CWE-787",
1998
2152
  "CWE-1395"
1999
2153
  ],
2000
- "d3fend_refs": [],
2154
+ "d3fend_refs": [
2155
+ "D3-EAL",
2156
+ "D3-EHB",
2157
+ "D3-PSEP",
2158
+ "D3-NI",
2159
+ "D3-NTPM",
2160
+ "D3-IOPR"
2161
+ ],
2001
2162
  "last_threat_review": "2026-06-10",
2002
2163
  "signature": "60hyXAiYfY9lI+EpHG3iFFxa+oF5n71c0tTMa6iXFLNjBJKPevTsdNgQlQsBEnmRJ+dWtOjb/GNBW1KiBx4XAQ==",
2003
- "signed_at": "2026-06-14T13:48:50.075Z",
2164
+ "signed_at": "2026-06-14T15:48:45.455Z",
2004
2165
  "forward_watch": [
2005
2166
  "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
2006
2167
  ]
@@ -2052,7 +2213,10 @@
2052
2213
  "SLSA-v1.0-Build-L3",
2053
2214
  "ISO-IEC-42001-2023-clause-6.1.2",
2054
2215
  "NIST-AI-RMF-MEASURE-2.5",
2055
- "OWASP-LLM-Top-10-2025-LLM08"
2216
+ "OWASP-LLM-Top-10-2025-LLM08",
2217
+ "EU-AI-Act-Art-15",
2218
+ "UK-CAF-A1",
2219
+ "AU-Essential-8-App-Hardening"
2056
2220
  ],
2057
2221
  "rfc_refs": [
2058
2222
  "RFC-8032"
@@ -2063,7 +2227,11 @@
2063
2227
  "CWE-1357",
2064
2228
  "CWE-502"
2065
2229
  ],
2066
- "d3fend_refs": [],
2230
+ "d3fend_refs": [
2231
+ "D3-EHB",
2232
+ "D3-EAL",
2233
+ "D3-IOPR"
2234
+ ],
2067
2235
  "last_threat_review": "2026-06-10",
2068
2236
  "forward_watch": [
2069
2237
  "CycloneDX 1.7 ML-BOM enrichment — training-data lineage fields and model-card embedding stabilize; re-baseline ML-BOM coverage when published",
@@ -2074,7 +2242,7 @@
2074
2242
  "MITRE ATLAS v2026.05 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
2075
2243
  ],
2076
2244
  "signature": "IEECw5lO6ZdpkE/j7Hv6/3Jg2vj9fpXlozY+h85Hrn9QYOJuI0gfBjHoBEchJ2GUTmPwUKoiBoI72PBAQw9RCQ==",
2077
- "signed_at": "2026-06-14T13:48:50.075Z"
2245
+ "signed_at": "2026-06-14T15:48:45.455Z"
2078
2246
  },
2079
2247
  {
2080
2248
  "name": "incident-response-playbook",
@@ -2119,11 +2287,23 @@
2119
2287
  "framework_gaps": [
2120
2288
  "NIST-800-53-AC-2",
2121
2289
  "ISO-27001-2022-A.8.16",
2122
- "SOC2-CC7-anomaly-detection"
2290
+ "SOC2-CC7-anomaly-detection",
2291
+ "NIS2-Art21-incident-handling",
2292
+ "UK-CAF-D1",
2293
+ "AU-Essential-8-Backup"
2294
+ ],
2295
+ "rfc_refs": [
2296
+ "RFC-6545",
2297
+ "RFC-6546",
2298
+ "RFC-7970"
2123
2299
  ],
2124
- "rfc_refs": [],
2125
2300
  "cwe_refs": [],
2126
- "d3fend_refs": [],
2301
+ "d3fend_refs": [
2302
+ "D3-RPA",
2303
+ "D3-NTA",
2304
+ "D3-IOPR",
2305
+ "D3-CSPP"
2306
+ ],
2127
2307
  "last_threat_review": "2026-06-10",
2128
2308
  "forward_watch": [
2129
2309
  "NIST 800-61r3 minor revisions (expected 2026-2027) aligning incident-handling language with the in-force EU CRA Art. 11 24h clock and EU AI Act Art. 73 serious-incident reporting",
@@ -2136,7 +2316,7 @@
2136
2316
  "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
2137
2317
  ],
2138
2318
  "signature": "pN1Qa5NRyNJ6h0pmbbqpy3xWdkMANDMUbBst5SKR5fmmqMFopmyrzwIGagiiNgqxjjCunj9J9Wbzs1sL48sMCQ==",
2139
- "signed_at": "2026-06-14T13:48:50.076Z"
2319
+ "signed_at": "2026-06-14T15:48:45.455Z"
2140
2320
  },
2141
2321
  {
2142
2322
  "name": "ransomware-response",
@@ -2216,7 +2396,7 @@
2216
2396
  ],
2217
2397
  "last_threat_review": "2026-06-10",
2218
2398
  "signature": "sXPA1lvWvZpf5sHxZXRkO0Kcs6gnXiYq0mWA53y1HeBwQGJ+viSPMt5IMobkjd5qLFYchg0CpW/nBUIvUE6/DA==",
2219
- "signed_at": "2026-06-14T13:48:50.076Z"
2399
+ "signed_at": "2026-06-14T15:48:45.456Z"
2220
2400
  },
2221
2401
  {
2222
2402
  "name": "email-security-anti-phishing",
@@ -2249,7 +2429,8 @@
2249
2429
  "cwe-catalog.json",
2250
2430
  "d3fend-catalog.json",
2251
2431
  "rfc-references.json",
2252
- "dlp-controls.json"
2432
+ "dlp-controls.json",
2433
+ "attack-techniques.json"
2253
2434
  ],
2254
2435
  "atlas_refs": [],
2255
2436
  "attack_refs": [
@@ -2262,14 +2443,28 @@
2262
2443
  "framework_gaps": [
2263
2444
  "NIST-800-53-SI-3",
2264
2445
  "ISO-27001-2022-A.8.16",
2265
- "SOC2-CC7-anomaly-detection"
2446
+ "SOC2-CC7-anomaly-detection",
2447
+ "NIS2-Art21-incident-handling",
2448
+ "UK-CAF-C1",
2449
+ "AU-Essential-8-App-Hardening"
2450
+ ],
2451
+ "rfc_refs": [
2452
+ "RFC-7489",
2453
+ "RFC-6376",
2454
+ "RFC-7208",
2455
+ "RFC-8616",
2456
+ "RFC-8461"
2266
2457
  ],
2267
- "rfc_refs": [],
2268
2458
  "cwe_refs": [],
2269
- "d3fend_refs": [],
2459
+ "d3fend_refs": [
2460
+ "D3-NTA",
2461
+ "D3-CSPP",
2462
+ "D3-IOPR",
2463
+ "D3-MFA"
2464
+ ],
2270
2465
  "last_threat_review": "2026-05-18",
2271
2466
  "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
2272
- "signed_at": "2026-06-14T13:48:50.076Z"
2467
+ "signed_at": "2026-06-14T15:48:45.456Z"
2273
2468
  },
2274
2469
  {
2275
2470
  "name": "age-gates-child-safety",
@@ -2314,7 +2509,10 @@
2314
2509
  "framework_gaps": [
2315
2510
  "ISO-27001-2022-A.8.30",
2316
2511
  "NIST-800-53-AC-2",
2317
- "SOC2-CC6-logical-access"
2512
+ "SOC2-CC6-logical-access",
2513
+ "NIS2-Art21-incident-handling",
2514
+ "UK-CAF-B2",
2515
+ "AU-Essential-8-MFA"
2318
2516
  ],
2319
2517
  "rfc_refs": [],
2320
2518
  "cwe_refs": [
@@ -2322,7 +2520,11 @@
2322
2520
  "CWE-287",
2323
2521
  "CWE-862"
2324
2522
  ],
2325
- "d3fend_refs": [],
2523
+ "d3fend_refs": [
2524
+ "D3-MFA",
2525
+ "D3-IOPR",
2526
+ "D3-CSPP"
2527
+ ],
2326
2528
  "last_threat_review": "2026-06-10",
2327
2529
  "forward_watch": [
2328
2530
  "KOSA (Kids Online Safety Act) federal enactment status — reintroduced 2024-2025 with bipartisan support; if enacted, duty-of-care + safest-defaults + age-appropriate-design obligations become US federal floor",
@@ -2337,7 +2539,7 @@
2337
2539
  "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
2338
2540
  ],
2339
2541
  "signature": "7Wdii9uwYmDrzQohoWRWDa5A4aDRKOmdLPq5Jsql86O0Gm7pQANnj9tX+cHpQcQ/Ui8VLuNVP8UFdKxxHeDnBg==",
2340
- "signed_at": "2026-06-14T13:48:50.077Z"
2542
+ "signed_at": "2026-06-14T15:48:45.457Z"
2341
2543
  },
2342
2544
  {
2343
2545
  "name": "cloud-iam-incident",
@@ -2417,7 +2619,7 @@
2417
2619
  ],
2418
2620
  "last_threat_review": "2026-05-15",
2419
2621
  "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
2420
- "signed_at": "2026-06-14T13:48:50.077Z",
2622
+ "signed_at": "2026-06-14T15:48:45.457Z",
2421
2623
  "forward_watch": [
2422
2624
  "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
2423
2625
  "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2511,7 +2713,7 @@
2511
2713
  ],
2512
2714
  "last_threat_review": "2026-05-15",
2513
2715
  "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
2514
- "signed_at": "2026-06-14T13:48:50.077Z",
2716
+ "signed_at": "2026-06-14T15:48:45.457Z",
2515
2717
  "forward_watch": [
2516
2718
  "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
2517
2719
  "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2583,7 +2785,7 @@
2583
2785
  "d3fend_refs": [],
2584
2786
  "last_threat_review": "2026-06-02",
2585
2787
  "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
2586
- "signed_at": "2026-06-14T13:48:50.078Z"
2788
+ "signed_at": "2026-06-14T15:48:45.458Z"
2587
2789
  },
2588
2790
  {
2589
2791
  "name": "mail-server-hardening",
@@ -2642,7 +2844,7 @@
2642
2844
  "d3fend_refs": [],
2643
2845
  "last_threat_review": "2026-06-02",
2644
2846
  "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
2645
- "signed_at": "2026-06-14T13:48:50.078Z"
2847
+ "signed_at": "2026-06-14T15:48:45.458Z"
2646
2848
  },
2647
2849
  {
2648
2850
  "name": "network-trust",
@@ -2698,7 +2900,7 @@
2698
2900
  "d3fend_refs": [],
2699
2901
  "last_threat_review": "2026-06-02",
2700
2902
  "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
2701
- "signed_at": "2026-06-14T13:48:50.078Z"
2903
+ "signed_at": "2026-06-14T15:48:45.458Z"
2702
2904
  },
2703
2905
  {
2704
2906
  "name": "audit-log-integrity",
@@ -2753,7 +2955,7 @@
2753
2955
  "d3fend_refs": [],
2754
2956
  "last_threat_review": "2026-06-02",
2755
2957
  "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
2756
- "signed_at": "2026-06-14T13:48:50.078Z"
2958
+ "signed_at": "2026-06-14T15:48:45.458Z"
2757
2959
  },
2758
2960
  {
2759
2961
  "name": "self-update-integrity",
@@ -2807,7 +3009,7 @@
2807
3009
  "d3fend_refs": [],
2808
3010
  "last_threat_review": "2026-06-02",
2809
3011
  "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
2810
- "signed_at": "2026-06-14T13:48:50.079Z"
3012
+ "signed_at": "2026-06-14T15:48:45.459Z"
2811
3013
  },
2812
3014
  {
2813
3015
  "name": "multitenancy-isolation",
@@ -2865,7 +3067,7 @@
2865
3067
  "d3fend_refs": [],
2866
3068
  "last_threat_review": "2026-06-02",
2867
3069
  "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
2868
- "signed_at": "2026-06-14T13:48:50.079Z"
3070
+ "signed_at": "2026-06-14T15:48:45.459Z"
2869
3071
  },
2870
3072
  {
2871
3073
  "name": "decompression-dos",
@@ -2923,7 +3125,7 @@
2923
3125
  "d3fend_refs": [],
2924
3126
  "last_threat_review": "2026-06-02",
2925
3127
  "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
2926
- "signed_at": "2026-06-14T13:48:50.079Z"
3128
+ "signed_at": "2026-06-14T15:48:45.459Z"
2927
3129
  },
2928
3130
  {
2929
3131
  "name": "log-injection-telemetry",
@@ -2978,7 +3180,7 @@
2978
3180
  "d3fend_refs": [],
2979
3181
  "last_threat_review": "2026-06-02",
2980
3182
  "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
2981
- "signed_at": "2026-06-14T13:48:50.079Z"
3183
+ "signed_at": "2026-06-14T15:48:45.459Z"
2982
3184
  },
2983
3185
  {
2984
3186
  "name": "privacy-consent-ops",
@@ -3033,11 +3235,11 @@
3033
3235
  "d3fend_refs": [],
3034
3236
  "last_threat_review": "2026-06-02",
3035
3237
  "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
3036
- "signed_at": "2026-06-14T13:48:50.079Z"
3238
+ "signed_at": "2026-06-14T15:48:45.460Z"
3037
3239
  }
3038
3240
  ],
3039
3241
  "manifest_signature": {
3040
3242
  "algorithm": "Ed25519",
3041
- "signature_base64": "3ElMjYBjWQ9qY57UTOZO77XJuK4SzIjIEVUMgXc+hOxL34RETEjH4ZIBGzyLrYQ4WCi13JqncrNuEgO2kL8wBw=="
3243
+ "signature_base64": "ZeIZdeJ5Ldlf6PXWpZu4Yzg1mCdC/1hrCnITyGdA5efTZcmvhvh97j2YBajS5LjOgSxzHb77JM5zVnvHgzl9Ag=="
3042
3244
  }
3043
3245
  }