@blamejs/exceptd-skills 0.19.17 → 0.19.19

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.19.19 — 2026-08-11
+
+Another 43 CVEs report the controls they require, taking coverage to 876 of 1025. The set includes Jenkins, Oracle WebLogic and Java SE, FortiManager, SonicWall's SMA appliances, Veeam Backup and Replication, Veritas Backup Exec, the Barracuda Email Security Gateway, PaperCut, Roundcube, and IP cameras from Dahua, Edimax and PTZOptics.
+
+An applied patch is not always the end state, and one entry says so in the vendor's own terms. Barracuda auto-applied the fix to every customer Email Security Gateway without the operator doing anything — and still advised replacing compromised units, because nothing restores the integrity of an appliance that was already backdoored. The operator's question on that product is therefore not whether the fix landed but whether the unit was held during the exposure window, which on an appliance the attacker controlled cannot be answered from the appliance's own logs. The requirement pairs the replacement default with off-box telemetry, so the record of what the appliance did outlives the appliance.
+
+Backup infrastructure is rated by what it protects, not by what it is. Three entries in this set put unauthenticated code execution on backup servers and agents, and each records the same gap between a fix existing and it being applied — a Backup Exec flaw was exploited for over a year against a fix already shipped, and Veeam servers were still unpatched when ransomware affiliates arrived roughly six weeks after the release. The requirement moves those hosts off the maintenance window their tier normally gets and onto the listing clock, and it names what an upgrade does not undo: the accounts created and the staging left behind on a server that was already reached.
+
+Where a vulnerability's scope is recorded as "per vendor advisory", the sweep is built from that advisory rather than from the models the description happens to name. The DrayTek entry names three Vigor models in its description while the affected-product record scopes it to the product line, so an inventory built from the description reports clean across an estate standardised on another model. The same entry declines to guess at end-of-support: a fix existing for this CVE says nothing about whether a given model can still receive one, so that is written as something to obtain per model — and the units driving this class of exploitation are the home-office and small-branch routers that were never in the patch inventory to begin with.
+
+## 0.19.18 — 2026-08-11
+
+Another 40 CVEs report the controls they require, taking coverage to 833 of 1025. The set includes Ivanti Connect Secure, PAN-OS, Confluence, VMware vCenter, Adobe ColdFusion, Firefox, Chromium, Windows Hyper-V, Oracle E-Business Suite, SonicWall's SSL-VPN, and the Realtek SDK.
+
+Where the vendor hosts the software, the patch obligations complete themselves. The Microsoft Partner Center fix was applied server-side, with nothing for an operator to install, schedule or attest — so all five patch-cadence controls citing the CVE can be marked satisfied by someone who did nothing and could have done nothing, while exploitation ran against the service. What the operator does hold is the relationship: Partner Center brokers access into downstream customer tenants, so the escalation lands on the delegated grant rather than on any one organisation's server. The requirement is validation and logging of the cross-tenant calls a partner identity makes, plus an incident path for a control plane whose remediation was never the operator's to perform.
+
+Whether a patch exists is a per-model question when the defect sits in a component other vendors embed. The Realtek SDK entry records an available fix alongside affected devices that are end-of-life with no fixed firmware, and the flaw is in a UPnP service shipped inside OEM router and IoT builds — so the answer comes from each OEM rather than being assumed either way across an estate. The requirement splits that estate into three states rather than the usual two: patched, mitigation-active with the WAN-side path blocked and a dated review, and no verdict — which is a device to retire, not a row to leave open.
+
+An appliance cannot be isolated out of doing its job. The FortiWeb command injection is reachable over crafted HTTP requests as well as the CLI, and serving HTTP is the entire reason the appliance is deployed, so restricting reachability narrows the management path for the duration and closes nothing. That entry also counts a unit carrying the new image but not yet restarted as still exposed, because the recorded fix requires the restart to take effect.
+
 ## 0.19.17 — 2026-08-11
 
 Another 41 CVEs report the controls they require, taking coverage to 793 of 1025. The set includes Chromium V8, Apple WebKit and CoreMedia, PAN-OS, MOVEit Transfer, SharePoint, Cisco ASA and Catalyst SD-WAN, Ivanti's Cloud Services Appliance, D-Link NAS devices, jQuery, and GNU Bash.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-11T09:01:39.003Z",
+  "generated_at": "2026-08-11T12:32:23.810Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "f1d6c26db0c69d4cfe6b5102ea2ea2f9e98326d46643247374297dec8ed18de4",
+    "manifest.json": "9c1408c795f3718ce9ddeb8c249b7d18e3168443d7ea530bf5375d699b977799",
     "README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
     "data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "d7c74ff511efedae14f975b1af26fc31d725d00b1657245a8625868df13ee344",
+    "data/zeroday-lessons.json": "b71fb59c9acb3c9ca9a2e4881b45aa959c23f0bc49264f5c26d18980ea2afe30",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",