@blamejs/exceptd-skills 0.19.28 → 0.19.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +26 -0
- package/data/_indexes/_meta.json +9 -9
- package/data/_indexes/activity-feed.json +8 -8
- package/data/_indexes/catalog-summaries.json +13 -13
- package/data/_indexes/chains.json +66696 -0
- package/data/_indexes/frequency.json +3 -0
- package/data/attack-techniques.json +311 -18
- package/data/cve-catalog.json +11168 -4
- package/data/cwe-catalog.json +193 -5
- package/data/framework-control-gaps.json +649 -5
- package/data/zeroday-lessons.json +9229 -2
- package/lib/cve-batch.js +38 -0
- package/manifest.json +53 -53
- package/package.json +2 -2
- package/sbom.cdx.json +27 -27
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,31 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.30 — 2026-08-18
|
|
4
|
+
|
|
5
|
+
Three CISA KEV entries join the catalog, taking it to 1,225. Each of them turns on a question its sources answer differently, which is why they landed a release later than the rest of their set.
|
|
6
|
+
|
|
7
|
+
The Ubiquiti AirOS command injection (CVE-2010-5330) is recorded as pre-authentication on the vendor's own words — Ubiquiti's advisory says the flaw grants access "without requiring authentication" and describes an HTTP server bug "allowing users to bypass authentication and run commands". The only published exploit reaches the injection from a read-only account, and an entry that treated that as the privilege boundary would tell an operator a radio behind a changed management password is lower priority. It is not: authentication is what the flaw bypasses. The entry also carries the self-propagating worm the same advisory documents, with the artefacts it leaves — a renamed CGI, a persistence script and a startup hook — and the vendor's removal tool, because upgrading firmware stops reinfection without clearing an existing infection.
|
|
8
|
+
|
|
9
|
+
The Windows User Profile Service escalation (CVE-2022-21919) records a vendor and a catalog that disagree. Microsoft's record still reports the flaw as not exploited while flagging it publicly disclosed with proof-of-concept code; CISA listed it three and a half months later. An operator checking the vendor feed to justify the remediation clock finds public exploit code and no vendor claim of in-the-wild use, so the entry states both rather than resolving them. It also separates the two remediations: the January 2022 rollup fixes it but every affected product is marked restart-required, while the third-party micropatch applies without a reboot and covers a narrower set of builds than the CVE does.
|
|
10
|
+
|
|
11
|
+
The macOS graphics driver out-of-bounds read (CVE-2022-22674) is scoped to every Mac below the fixed build, not to Intel hardware. Apple names the affected component "Intel Graphics Driver" on macOS Monterey but files the same CVE under the generic "Graphics Drivers" on Big Sur and Catalina — advisories that use the Intel-specific heading for other CVEs on the same page — and Big Sur is the first macOS release that runs on Apple silicon. Nothing Apple published places Apple silicon out of scope, so an estate that excluded those machines on the component name would have left them unpatched against a flaw Apple acknowledged as exploited.
|
|
12
|
+
|
|
13
|
+
A batch curation run that adds an entry already in the catalog is now refused instead of writing it twice. The apply step splices new members into the catalog file and cannot replace an existing one, so re-running it produced duplicate JSON keys; the parser keeps the last of those, which is the copy already on disk, and the newer entry was discarded while the entry count, the schema check and the orphan scan all still passed. Both the dry run and the write now report the collision and name the entries, so the condition is visible before anything is written.
|
|
14
|
+
|
|
15
|
+
## 0.19.29 — 2026-08-17
|
|
16
|
+
|
|
17
|
+
The catalog reaches 1,222 CVEs with 97 additions drawn from CISA KEV, weighted towards the recent end of the backlog: 19 from 2022, 20 from 2021, 18 from 2019, and a long tail back to 2007. Microsoft accounts for 30, Apple 9, Adobe 7 and Google 5, with the rest spread across Cisco, VMware, Kaseya, QNAP, Zyxel, D-Link and the router and storage-appliance vendors whose products dominate the older listings. Twenty carry CISA's ransomware designation and 63 have an obtainable public exploit.
|
|
18
|
+
|
|
19
|
+
For fourteen of them CISA's required action is not "patch" but "disconnect": the product is end-of-life and the terminal state is removal. Six have no vendor fix at all. Those entries name removal as the remediation rather than describing an upgrade path that does not exist, and where a vendor published nothing the entry cites the distribution or coordinating advisory that did — Ubuntu's for the Debian-specific Redis packaging flaw, Red Hat's for Dirty Pipe, Kaseya's own bulletin for the ConnectWise integration that shipped on its server.
|
|
20
|
+
|
|
21
|
+
Fifty-seven of the additions need a restart before the fix is running, and the entries separate that from the update being installed. A kernel extension or a graphics driver keeps serving the vulnerable code until the process or the machine restarts, so a remediation record keyed to the deployed version reports hosts as done while the pre-patch code is still executing. Where the restart is the step users defer, the entry says so and tells you to verify against the running build.
|
|
22
|
+
|
|
23
|
+
Where sources disagree, the entries carry the disagreement rather than choosing the convenient reading. For CVE-2022-26904 Microsoft records the flaw as not exploited while CISA added it to KEV thirteen days later, and the entry states both. NVD's CPE list for CVE-2022-22954 names vRealize Automation 7.6 while VMware's own advisory records it as unaffected, so the entry scopes vRealize Automation out of that CVE and keeps it in scope for CVE-2022-22960. Adobe withdrew Flash Player 11.x for Windows and macOS from its CVE-2015-0313 advisory in February 2015, on the grounds that those builds do not support the affected functionality — and the entry records that the withdrawal does not carry to the Linux line, which Adobe's own patch bulletin and NVD both still place in scope below 11.2.202.442.
|
|
24
|
+
|
|
25
|
+
Public-exploit availability is recorded as a finding in both directions. A negative is earned by searching Exploit-DB, the Metasploit module tree, the Nuclei templates and public repositories and saying what was checked, because that flag drives a fifth of the priority score. Several entries record a near miss explicitly — a Metasploit module that belongs to an adjacent CVE, a research write-up with no code, an exploit whose author withheld it — so the absence can be re-checked rather than taken on trust.
|
|
26
|
+
|
|
27
|
+
CWE-193, CWE-281 and CWE-665 join the weakness catalog to carry the off-by-one, permission-preservation and uninitialised-memory entries among these additions, taking it to 236.
|
|
28
|
+
|
|
3
29
|
## 0.19.28 — 2026-08-16
|
|
4
30
|
|
|
5
31
|
The project-rules file opens with a table instead of a seven-sentence paragraph. Which assistants load `AGENTS.md` on their own, which take a pointer stub, and which need it added by hand was written as running prose, so the reader had to parse three categories out of one block to find their own tool. The rows carry the same tool names and config paths as before.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,22 +1,22 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-18T05:32:14.962Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "81aa6acc7b57248f3efecb64f57223583366556ddbf2f8ede02677c4ae36b2b7",
|
|
8
8
|
"README.md": "a757b8ed9923b7954518d00a768d338800460c9a90811094f050710fe9888615",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
|
-
"data/attack-techniques.json": "
|
|
11
|
-
"data/cve-catalog.json": "
|
|
12
|
-
"data/cwe-catalog.json": "
|
|
10
|
+
"data/attack-techniques.json": "4ac69e35dccb7a5f3eb3a8fefdfcb4ba5892345bddb5fa4d673ca6e336451ad8",
|
|
11
|
+
"data/cve-catalog.json": "c561377a52c2840f637e587175fa97c1ce96b35ad0431ec2491ecd63b70d29dd",
|
|
12
|
+
"data/cwe-catalog.json": "edfa10d0a1ade79c0cbc1ca928d0240e2d30b11302c453fed5cf440122d7424e",
|
|
13
13
|
"data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
|
|
14
14
|
"data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
|
|
15
15
|
"data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
|
|
16
|
-
"data/framework-control-gaps.json": "
|
|
16
|
+
"data/framework-control-gaps.json": "927cf02d5ed3ec43a822e222a53f891ff0452e36fc5606b868e6dfc3f320e524",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "7d06853a6a4b151620044190296a2e20b3d904333b5565863ecf1a75eb9e7c0a",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|
|
@@ -101,8 +101,8 @@
|
|
|
101
101
|
"dlp_refs": 0
|
|
102
102
|
},
|
|
103
103
|
"trigger_table_entries": 688,
|
|
104
|
-
"chains_cve_entries":
|
|
105
|
-
"chains_cwe_entries":
|
|
104
|
+
"chains_cve_entries": 1212,
|
|
105
|
+
"chains_cwe_entries": 236,
|
|
106
106
|
"jurisdictions_indexed": 34,
|
|
107
107
|
"handoff_dag_nodes": 51,
|
|
108
108
|
"summary_cards": 51,
|
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
},
|
|
7
7
|
"events": [
|
|
8
8
|
{
|
|
9
|
-
"date": "2026-08-
|
|
9
|
+
"date": "2026-08-18",
|
|
10
10
|
"type": "catalog_update",
|
|
11
11
|
"artifact": "data/attack-techniques.json",
|
|
12
12
|
"path": "data/attack-techniques.json",
|
|
@@ -14,23 +14,23 @@
|
|
|
14
14
|
"entry_count": 794
|
|
15
15
|
},
|
|
16
16
|
{
|
|
17
|
-
"date": "2026-08-
|
|
17
|
+
"date": "2026-08-18",
|
|
18
18
|
"type": "catalog_update",
|
|
19
19
|
"artifact": "data/cve-catalog.json",
|
|
20
20
|
"path": "data/cve-catalog.json",
|
|
21
21
|
"schema_version": "1.0.0",
|
|
22
|
-
"entry_count":
|
|
22
|
+
"entry_count": 1225
|
|
23
23
|
},
|
|
24
24
|
{
|
|
25
|
-
"date": "2026-08-
|
|
25
|
+
"date": "2026-08-18",
|
|
26
26
|
"type": "catalog_update",
|
|
27
27
|
"artifact": "data/cwe-catalog.json",
|
|
28
28
|
"path": "data/cwe-catalog.json",
|
|
29
29
|
"schema_version": "1.0.0",
|
|
30
|
-
"entry_count":
|
|
30
|
+
"entry_count": 236
|
|
31
31
|
},
|
|
32
32
|
{
|
|
33
|
-
"date": "2026-08-
|
|
33
|
+
"date": "2026-08-18",
|
|
34
34
|
"type": "catalog_update",
|
|
35
35
|
"artifact": "data/framework-control-gaps.json",
|
|
36
36
|
"path": "data/framework-control-gaps.json",
|
|
@@ -38,12 +38,12 @@
|
|
|
38
38
|
"entry_count": 194
|
|
39
39
|
},
|
|
40
40
|
{
|
|
41
|
-
"date": "2026-08-
|
|
41
|
+
"date": "2026-08-18",
|
|
42
42
|
"type": "catalog_update",
|
|
43
43
|
"artifact": "data/zeroday-lessons.json",
|
|
44
44
|
"path": "data/zeroday-lessons.json",
|
|
45
45
|
"schema_version": "1.1.0",
|
|
46
|
-
"entry_count":
|
|
46
|
+
"entry_count": 1225
|
|
47
47
|
},
|
|
48
48
|
{
|
|
49
49
|
"date": "2026-08-08",
|
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
"path": "data/attack-techniques.json",
|
|
32
32
|
"purpose": null,
|
|
33
33
|
"schema_version": "1.0.0",
|
|
34
|
-
"last_updated": "2026-08-
|
|
34
|
+
"last_updated": "2026-08-18",
|
|
35
35
|
"tlp": "CLEAR",
|
|
36
36
|
"source_confidence_default": "A1",
|
|
37
37
|
"freshness_policy": {
|
|
@@ -53,7 +53,7 @@
|
|
|
53
53
|
"path": "data/cve-catalog.json",
|
|
54
54
|
"purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
|
|
55
55
|
"schema_version": "1.0.0",
|
|
56
|
-
"last_updated": "2026-08-
|
|
56
|
+
"last_updated": "2026-08-18",
|
|
57
57
|
"tlp": "CLEAR",
|
|
58
58
|
"source_confidence_default": "A1",
|
|
59
59
|
"freshness_policy": {
|
|
@@ -62,20 +62,20 @@
|
|
|
62
62
|
"rebuild_after_days": 365,
|
|
63
63
|
"note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
|
|
64
64
|
},
|
|
65
|
-
"entry_count":
|
|
65
|
+
"entry_count": 1225,
|
|
66
66
|
"sample_keys": [
|
|
67
|
-
"CVE-
|
|
68
|
-
"CVE-
|
|
69
|
-
"CVE-
|
|
70
|
-
"CVE-
|
|
71
|
-
"CVE-
|
|
67
|
+
"CVE-2010-5330",
|
|
68
|
+
"CVE-2022-21919",
|
|
69
|
+
"CVE-2022-22674",
|
|
70
|
+
"CVE-2007-3010",
|
|
71
|
+
"CVE-2014-0160"
|
|
72
72
|
]
|
|
73
73
|
},
|
|
74
74
|
"cwe-catalog.json": {
|
|
75
75
|
"path": "data/cwe-catalog.json",
|
|
76
76
|
"purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
|
|
77
77
|
"schema_version": "1.0.0",
|
|
78
|
-
"last_updated": "2026-08-
|
|
78
|
+
"last_updated": "2026-08-18",
|
|
79
79
|
"tlp": "CLEAR",
|
|
80
80
|
"source_confidence_default": "A1",
|
|
81
81
|
"freshness_policy": {
|
|
@@ -84,7 +84,7 @@
|
|
|
84
84
|
"rebuild_after_days": 365,
|
|
85
85
|
"note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
|
|
86
86
|
},
|
|
87
|
-
"entry_count":
|
|
87
|
+
"entry_count": 236,
|
|
88
88
|
"sample_keys": [
|
|
89
89
|
"CWE-20",
|
|
90
90
|
"CWE-22",
|
|
@@ -163,7 +163,7 @@
|
|
|
163
163
|
"path": "data/framework-control-gaps.json",
|
|
164
164
|
"purpose": "Per-control framework gap declarations: SI-2, A.8.8, PCI 6.3.3, etc. Each entry names the control, the lag, the evidence CVE, and remediation guidance.",
|
|
165
165
|
"schema_version": "1.0.0",
|
|
166
|
-
"last_updated": "2026-08-
|
|
166
|
+
"last_updated": "2026-08-18",
|
|
167
167
|
"tlp": "CLEAR",
|
|
168
168
|
"source_confidence_default": "A1",
|
|
169
169
|
"freshness_policy": {
|
|
@@ -229,7 +229,7 @@
|
|
|
229
229
|
"path": "data/zeroday-lessons.json",
|
|
230
230
|
"purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
|
|
231
231
|
"schema_version": "1.1.0",
|
|
232
|
-
"last_updated": "2026-08-
|
|
232
|
+
"last_updated": "2026-08-18",
|
|
233
233
|
"tlp": "CLEAR",
|
|
234
234
|
"source_confidence_default": "B2",
|
|
235
235
|
"freshness_policy": {
|
|
@@ -238,7 +238,7 @@
|
|
|
238
238
|
"rebuild_after_days": 365,
|
|
239
239
|
"note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
|
|
240
240
|
},
|
|
241
|
-
"entry_count":
|
|
241
|
+
"entry_count": 1225,
|
|
242
242
|
"sample_keys": [
|
|
243
243
|
"CVE-2026-31431",
|
|
244
244
|
"CVE-2025-53773",
|