@blamejs/exceptd-skills 0.19.10 → 0.19.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +16 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +1887 -70
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,21 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.12 — 2026-08-10
|
|
4
|
+
|
|
5
|
+
Another 34 CVEs report the controls they require, taking coverage to 608 of 1025. The set includes Soliton FileZen, Ivanti EPMM and Cloud Services Appliance, DELMIA Apriso, Hikvision, PTC Windchill, Dovecot, and Linux and Android kernel entries.
|
|
6
|
+
|
|
7
|
+
Where a catalog entry contradicts itself, the requirement now says so rather than choosing a reading. The FileZen entry describes the command injection as reached after a product login in one field and as unauthenticated in another; the control states both readings and which interim measure survives under each, because an account-side restriction is worthless if the second reading is the true one, and recording it as the mitigation would be the failure this field exists to catch.
|
|
8
|
+
|
|
9
|
+
Appliance entries state the restart as the completion criterion rather than a step after it. On a file-transfer appliance the restart interrupts in-flight transfers, which makes it exactly the step that gets deferred while the update is recorded as deployed — so the requirement is the running software level and the timestamp of the restart that activated it, per unit.
|
|
10
|
+
|
|
11
|
+
## 0.19.11 — 2026-08-10
|
|
12
|
+
|
|
13
|
+
Another 36 CVEs report the controls they require, taking coverage to 574 of 1025. The set includes the Qualcomm Adreno driver flaw, Fortra GoAnywhere MFT, Rails, TP-Link routers, Palo Alto Expedition, the Windows CLFS driver, and Apple memory-corruption entries.
|
|
14
|
+
|
|
15
|
+
The Qualcomm entry states a case the patch controls cited against it cannot express: the vulnerable code is a hardware-vendor driver, so no operator publishes its fix — it arrives only inside a device build for that chipset. The requirement is therefore the fixed build enforced as a condition of access to organizational data, with the device that has no fixed build available named as unremediated rather than filed as a deferral, since the only remaining levers there are withholding data and replacement. A browser update does not reach the driver even though the flaw triggers while rendering, and the entry says so instead of pointing at a fix that does not touch the vulnerable code.
|
|
16
|
+
|
|
17
|
+
Requirements that assume a telemetry agent now say where they do not run. A detection prescribing host audit rules was left off the mobile-driver entry on the grounds that it could never observe the privilege transition on that device class — a rule recorded as coverage while detecting nothing is worse than an acknowledged gap.
|
|
18
|
+
|
|
3
19
|
## 0.19.10 — 2026-08-10
|
|
4
20
|
|
|
5
21
|
Another 39 CVEs report the controls they require, taking coverage to 538 of 1025. The set includes the WSUS deserialization flaw, Grafana and Roundcube, Quest KACE, Samsung mobile, Chromium ANGLE, and the QNAP Pwn2Own chain.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-10T12:25:45.900Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "ecbbeb9c224cd90f97dacb26c72d7fd76f7cf0167753bb4e8d6ce013ff640f6d",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "87c5e110e1e5e17d5bdaebb6b7bba73e173cd9b21a54207fd8c9f8257eb24fcd",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|