@blamejs/exceptd-skills 0.19.10 → 0.19.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +967 -36
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.11 — 2026-08-10
|
|
4
|
+
|
|
5
|
+
Another 36 CVEs report the controls they require, taking coverage to 574 of 1025. The set includes the Qualcomm Adreno driver flaw, Fortra GoAnywhere MFT, Rails, TP-Link routers, Palo Alto Expedition, the Windows CLFS driver, and Apple memory-corruption entries.
|
|
6
|
+
|
|
7
|
+
The Qualcomm entry states a case the patch controls cited against it cannot express: the vulnerable code is a hardware-vendor driver, so no operator publishes its fix — it arrives only inside a device build for that chipset. The requirement is therefore the fixed build enforced as a condition of access to organizational data, with the device that has no fixed build available named as unremediated rather than filed as a deferral, since the only remaining levers there are withholding data and replacement. A browser update does not reach the driver even though the flaw triggers while rendering, and the entry says so instead of pointing at a fix that does not touch the vulnerable code.
|
|
8
|
+
|
|
9
|
+
Requirements that assume a telemetry agent now say where they do not run. A detection prescribing host audit rules was left off the mobile-driver entry on the grounds that it could never observe the privilege transition on that device class — a rule recorded as coverage while detecting nothing is worse than an acknowledged gap.
|
|
10
|
+
|
|
3
11
|
## 0.19.10 — 2026-08-10
|
|
4
12
|
|
|
5
13
|
Another 39 CVEs report the controls they require, taking coverage to 538 of 1025. The set includes the WSUS deserialization flaw, Grafana and Roundcube, Quest KACE, Samsung mobile, Chromium ANGLE, and the QNAP Pwn2Own chain.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-10T10:26:12.869Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "5948d1ba4ea69a91789fb68aa43d71f3a01b07bbde5ac94d8fc45acb941314ad",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "9238c3af5655702893cab9125b0b0c97022af7e2e71110fb5602ba60c8fbc7d2",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|