@blamejs/exceptd-skills 0.19.12 → 0.19.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +891 -34
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.13 — 2026-08-10
|
|
4
|
+
|
|
5
|
+
Another 34 CVEs report the controls they require, taking coverage to 642 of 1025. The set includes BeyondTrust Remote Support and Privileged Remote Access, Cisco Unified Communications and Catalyst SD-WAN, Sitecore, TP-Link, and Windows and Linux kernel entries.
|
|
6
|
+
|
|
7
|
+
The catalog now checks that a control stays attached to the CVE it was written for. The link is the framework gap: a control claims to close a gap that the framework catalog already cites that CVE as evidence for, so a control moved onto an unrelated CVE breaks a reference that generic structure checks cannot see. A hundred and five older references sit outside that rule and are grandfathered by count rather than silently accepted; the check fails if the number grows.
|
|
8
|
+
|
|
9
|
+
Where remote-access products are concerned, the requirements say what isolation cannot do. Remote Support and Privileged Remote Access exist in order to be reachable, so "restrict the interface instead of meeting the clock" is only available where an operator can name a user population whose access can be suspended for the duration — and where they cannot, the update and its restart are the only lever, with nothing to record in its place.
|
|
10
|
+
|
|
3
11
|
## 0.19.12 — 2026-08-10
|
|
4
12
|
|
|
5
13
|
Another 34 CVEs report the controls they require, taking coverage to 608 of 1025. The set includes Soliton FileZen, Ivanti EPMM and Cloud Services Appliance, DELMIA Apriso, Hikvision, PTC Windchill, Dovecot, and Linux and Android kernel entries.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-10T14:31:26.095Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "c15e1f17f98d3c8436502cda442200177e3aeecf3ce88e466aa0997efac9d8b6",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "c1e4c740db3f343e0d8925ed34002750f9affb747fdf9856b74ad5333f1d02c7",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|