@blamejs/exceptd-skills 0.19.15 → 0.19.17

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.19.17 — 2026-08-11
+
+Another 41 CVEs report the controls they require, taking coverage to 793 of 1025. The set includes Chromium V8, Apple WebKit and CoreMedia, PAN-OS, MOVEit Transfer, SharePoint, Cisco ASA and Catalyst SD-WAN, Ivanti's Cloud Services Appliance, D-Link NAS devices, jQuery, and GNU Bash.
+
+Where the vulnerable code is a file rather than a package, the scan's silence is not a finding of absence. jQuery ships inside applications — vendored into a web root, emitted by a build step, embedded in a third-party product's web interface — and the affected range covers effectively every copy ever placed that way, so an inventory keyed to installed packages has no row to report on. The entry also names the second measurement that reads clean: the vulnerability's own text says the untrusted HTML executes even after sanitizing it, so an application recording sanitization as its mitigation has recorded something the defect is documented to survive.
+
+Some entries have no fixed build to reach. The D-Link NAS devices are past end of support with the vendor's confirmation on record, no patch, and no live-patch path — so removal is the requirement rather than a step after patching, and restricting reachability is the only lever an operator holds for as long as a unit stays in service. On appliances holding the primary and backup copy of a site's files, that distinction is the whole disposition.
+
+A CVE's identifier year is not its remediation priority. The Bash entry carries a 2014 identifier and a 2025 listing date, so a process that ages work by identifier files it as historical while the clock is running — the requirement is that the listing, not the year, sets the queue position. It also separates a family-level attestation from this member: an estate that closed its Shellshock work on "newer than the first fix" has not shown the build carrying the fix for this defect, and the population that needs it is the hosts where attacker-controlled data actually reaches a Bash environment rather than every host with Bash installed.
+
+## 0.19.16 — 2026-08-10
+
+Another 39 CVEs report the controls they require, taking coverage to 752 of 1025. The set includes React Native's development server, React Server Components, F5 BIG-IP, Fortinet SSL-VPN, Ivanti Connect Secure, PAN-OS, SonicWall, SAP NetWeaver, Oracle E-Business Suite, ImageMagick, and the Windows CLFS and CNG entries.
+
+Some of these put the clock somewhere the production patch pipeline never reaches. The React Native command-line tool's development server runs on developer workstations and build images, so an estate can complete a patch cycle with the exposure untouched — and the exposure exists only while a development server is running and answering from the network, which no patch-posture dashboard reports on. Completion is counted per host and per build image, and the running process is named as the step that slips: updating the package while a server keeps serving from a pre-fix load leaves the host exposed.
+
+Where the vulnerable code arrives beneath what a team declares, the inventory has to resolve it. The React Server Components defect is in React's own payload decoder, and React is usually not the declared dependency — the application declares the rendering framework and React comes underneath it. The version recorded has to be the one linked into the deployed artifact, tested by extracting it from a build that is answering requests rather than from the repository, because a merged dependency bump and a deployed pre-fix build read the same on a patch attestation.
+
+Security tooling is carried as an asset like anything else. The Cobalt Strike client is a per-operator install that managed software distribution generally never sees, so the estate's patch report has no row for it and the absence reads as compliance — while the defect runs the engagement's data flow backwards, rendering implant data from a host under someone else's control in the operator's own console. The requirement counts the client per operator workstation rather than per team server, and puts the engagement toolchain itself inside the scope that treats it as attack surface with an untrusted input path.
+
 ## 0.19.15 — 2026-08-10
 
 Another 35 CVEs report the controls they require, taking coverage to 713 of 1025. The set includes HPE OneView, the Windows CLFS driver, SharePoint, Outlook, Adobe ColdFusion, Citrix Session Recording, and the Cisco and D-Link router entries.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-10T21:48:36.855Z",
+  "generated_at": "2026-08-11T09:01:39.003Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4c5c2c21053de02ddf77f31292368776dea6376491aba48173b0a96864b20e75",
+    "manifest.json": "f1d6c26db0c69d4cfe6b5102ea2ea2f9e98326d46643247374297dec8ed18de4",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "fabc33c100e23088661fb5f4ee1f361180e7fa44134bfe1e5e4215af519dc904",
+    "data/zeroday-lessons.json": "d7c74ff511efedae14f975b1af26fc31d725d00b1657245a8625868df13ee344",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",

package/data/_indexes/activity-feed.json

@@ -6,7 +6,7 @@
   },
   "events": [
     {
-      "date": "2026-08-10",
+      "date": "2026-08-11",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",

package/data/_indexes/catalog-summaries.json

@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-08-10",
+      "last_updated": "2026-08-11",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {