@blamejs/exceptd-skills 0.19.15 → 0.19.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/zeroday-lessons.json +1259 -253
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.16 — 2026-08-10
|
|
4
|
+
|
|
5
|
+
Another 39 CVEs report the controls they require, taking coverage to 752 of 1025. The set includes React Native's development server, React Server Components, F5 BIG-IP, Fortinet SSL-VPN, Ivanti Connect Secure, PAN-OS, SonicWall, SAP NetWeaver, Oracle E-Business Suite, ImageMagick, and the Windows CLFS and CNG entries.
|
|
6
|
+
|
|
7
|
+
Some of these put the clock somewhere the production patch pipeline never reaches. The React Native command-line tool's development server runs on developer workstations and build images, so an estate can complete a patch cycle with the exposure untouched — and the exposure exists only while a development server is running and answering from the network, which no patch-posture dashboard reports on. Completion is counted per host and per build image, and the running process is named as the step that slips: updating the package while a server keeps serving from a pre-fix load leaves the host exposed.
|
|
8
|
+
|
|
9
|
+
Where the vulnerable code arrives beneath what a team declares, the inventory has to resolve it. The React Server Components defect is in React's own payload decoder, and React is usually not the declared dependency — the application declares the rendering framework and React comes underneath it. The version recorded has to be the one linked into the deployed artifact, tested by extracting it from a build that is answering requests rather than from the repository, because a merged dependency bump and a deployed pre-fix build read the same on a patch attestation.
|
|
10
|
+
|
|
11
|
+
Security tooling is carried as an asset like anything else. The Cobalt Strike client is a per-operator install that managed software distribution generally never sees, so the estate's patch report has no row for it and the absence reads as compliance — while the defect runs the engagement's data flow backwards, rendering implant data from a host under someone else's control in the operator's own console. The requirement counts the client per operator workstation rather than per team server, and puts the engagement toolchain itself inside the scope that treats it as attack surface with an untrusted input path.
|
|
12
|
+
|
|
3
13
|
## 0.19.15 — 2026-08-10
|
|
4
14
|
|
|
5
15
|
Another 35 CVEs report the controls they require, taking coverage to 713 of 1025. The set includes HPE OneView, the Windows CLFS driver, SharePoint, Outlook, Adobe ColdFusion, Citrix Session Recording, and the Cisco and D-Link router entries.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-11T06:34:54.393Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "c9388c82ab6cfe10577db246ab26ee8f2185abaa4bd134c00d8f261b2d02f2e2",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "9bb88ec789870a08a83fb28e5a24fbfa9453146d2de2c9b54bd2ecb92af6a79b",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|