@blamejs/exceptd-skills 0.19.29 → 0.19.30

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.19.30 — 2026-08-18
+
+Three CISA KEV entries join the catalog, taking it to 1,225. Each of them turns on a question its sources answer differently, which is why they landed a release later than the rest of their set.
+
+The Ubiquiti AirOS command injection (CVE-2010-5330) is recorded as pre-authentication on the vendor's own words — Ubiquiti's advisory says the flaw grants access "without requiring authentication" and describes an HTTP server bug "allowing users to bypass authentication and run commands". The only published exploit reaches the injection from a read-only account, and an entry that treated that as the privilege boundary would tell an operator a radio behind a changed management password is lower priority. It is not: authentication is what the flaw bypasses. The entry also carries the self-propagating worm the same advisory documents, with the artefacts it leaves — a renamed CGI, a persistence script and a startup hook — and the vendor's removal tool, because upgrading firmware stops reinfection without clearing an existing infection.
+
+The Windows User Profile Service escalation (CVE-2022-21919) records a vendor and a catalog that disagree. Microsoft's record still reports the flaw as not exploited while flagging it publicly disclosed with proof-of-concept code; CISA listed it three and a half months later. An operator checking the vendor feed to justify the remediation clock finds public exploit code and no vendor claim of in-the-wild use, so the entry states both rather than resolving them. It also separates the two remediations: the January 2022 rollup fixes it but every affected product is marked restart-required, while the third-party micropatch applies without a reboot and covers a narrower set of builds than the CVE does.
+
+The macOS graphics driver out-of-bounds read (CVE-2022-22674) is scoped to every Mac below the fixed build, not to Intel hardware. Apple names the affected component "Intel Graphics Driver" on macOS Monterey but files the same CVE under the generic "Graphics Drivers" on Big Sur and Catalina — advisories that use the Intel-specific heading for other CVEs on the same page — and Big Sur is the first macOS release that runs on Apple silicon. Nothing Apple published places Apple silicon out of scope, so an estate that excluded those machines on the component name would have left them unpatched against a flaw Apple acknowledged as exploited.
+
+A batch curation run that adds an entry already in the catalog is now refused instead of writing it twice. The apply step splices new members into the catalog file and cannot replace an existing one, so re-running it produced duplicate JSON keys; the parser keeps the last of those, which is the copy already on disk, and the newer entry was discarded while the entry count, the schema check and the orphan scan all still passed. Both the dry run and the write now report the collision and name the entries, so the condition is visible before anything is written.
+
 ## 0.19.29 — 2026-08-17
 
 The catalog reaches 1,222 CVEs with 97 additions drawn from CISA KEV, weighted towards the recent end of the backlog: 19 from 2022, 20 from 2021, 18 from 2019, and a long tail back to 2007. Microsoft accounts for 30, Apple 9, Adobe 7 and Google 5, with the rest spread across Cisco, VMware, Kaseya, QNAP, Zyxel, D-Link and the router and storage-appliance vendors whose products dominate the older listings. Twenty carry CISA's ransomware designation and 63 have an obtainable public exploit.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-18T00:40:31.568Z",
+  "generated_at": "2026-08-18T05:32:14.962Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4d4b46566e0bd850f5a0d11198c88531bb8a5f4b88facb5a07c9bbf4e16a48eb",
+    "manifest.json": "81aa6acc7b57248f3efecb64f57223583366556ddbf2f8ede02677c4ae36b2b7",
     "README.md": "a757b8ed9923b7954518d00a768d338800460c9a90811094f050710fe9888615",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "fc1addff406771bf183b8ccae411b583fd9a3da62cb753e6e67bdb50a6160ee2",
-    "data/cve-catalog.json": "b55dd412109456bb74d68f6e0b3152debf83ae6352fd867d72add231714d8079",
-    "data/cwe-catalog.json": "e94700cbd1e6b2670efd694587c2b889f58e50b2f574f8a2c954eb879f08a570",
+    "data/attack-techniques.json": "4ac69e35dccb7a5f3eb3a8fefdfcb4ba5892345bddb5fa4d673ca6e336451ad8",
+    "data/cve-catalog.json": "c561377a52c2840f637e587175fa97c1ce96b35ad0431ec2491ecd63b70d29dd",
+    "data/cwe-catalog.json": "edfa10d0a1ade79c0cbc1ca928d0240e2d30b11302c453fed5cf440122d7424e",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "51563f5ee3b85a1c155be9cf9aac629bf69d4d54dfeefb7d90c7eade366af4be",
+    "data/framework-control-gaps.json": "927cf02d5ed3ec43a822e222a53f891ff0452e36fc5606b868e6dfc3f320e524",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "44ca23d11ef8fa7fd35a1bd4094ec215d7b2ffb8797922e6d6453bd2ad11f11d",
+    "data/zeroday-lessons.json": "7d06853a6a4b151620044190296a2e20b3d904333b5565863ecf1a75eb9e7c0a",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1209,
+    "chains_cve_entries": 1212,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -19,7 +19,15 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1222
+      "entry_count": 1225
+    },
+    {
+      "date": "2026-08-18",
+      "type": "catalog_update",
+      "artifact": "data/cwe-catalog.json",
+      "path": "data/cwe-catalog.json",
+      "schema_version": "1.0.0",
+      "entry_count": 236
     },
     {
       "date": "2026-08-18",
@@ -35,15 +43,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1222
-    },
-    {
-      "date": "2026-08-17",
-      "type": "catalog_update",
-      "artifact": "data/cwe-catalog.json",
-      "path": "data/cwe-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 236
+      "entry_count": 1225
     },
     {
       "date": "2026-08-08",

package/data/_indexes/catalog-summaries.json

@@ -62,20 +62,20 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1222,
+      "entry_count": 1225,
       "sample_keys": [
+        "CVE-2010-5330",
+        "CVE-2022-21919",
+        "CVE-2022-22674",
         "CVE-2007-3010",
-        "CVE-2014-0160",
-        "CVE-2014-0322",
-        "CVE-2014-0780",
-        "CVE-2014-4113"
+        "CVE-2014-0160"
       ]
     },
     "cwe-catalog.json": {
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-17",
+      "last_updated": "2026-08-18",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1222,
+      "entry_count": 1225,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",