@blamejs/exceptd-skills 0.19.30 → 0.19.31

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.19.31 — 2026-08-19
+
+The catalog reaches 1,323 CVEs with 98 additions from CISA KEV, spanning 2005 to 2025 with the weight in the middle years: 15 from 2019, 11 from 2016, 10 each from 2018 and 2020. Microsoft accounts for 29, with Adobe, Cisco, D-Link, Oracle, Apache, Citrix, NETGEAR and VMware behind it. Twenty-four carry CISA's ransomware designation and 76 have an obtainable public exploit.
+
+Fifty-one need a restart before the fix is running, and the entries keep that separate from the update being installed. A browser engine, a kernel extension or a service DLL keeps serving the vulnerable code until the process or the host restarts, so a remediation record keyed to the deployed version reports hosts as done while the pre-patch code executes. For nine of the additions CISA's required action is removal rather than patching, and five have no vendor fix at all; those entries name removal as the remediation instead of describing an upgrade path that does not exist.
+
+Where sources disagree, the entries carry the disagreement. A Metasploit module frames CVE-2013-2551 as an integer overflow while NVD and Microsoft classify it as a use-after-free, and the entry leads with the vendor classification while describing the path the public tooling drives. Where a vendor publishes an unspecified-vulnerability row and nothing more, as Oracle does for CVE-2012-0518, the entry says the mechanism is not on the public record rather than inventing one.
+
+Public-exploit availability is recorded as a finding in both directions, and a negative names the check that produced it: which index was searched, and a public CVE whose entries that same search returns, so a reader can tell a real absence from a broken query. Several entries record a near miss explicitly — a Metasploit module belonging to an adjacent CVE, a write-up with no code, an exploit whose author withheld it.
+
+Framework-gap statements now rest on each CVE's own dates, versions, KB numbers and vendor wording. Claims about what organisations typically do — which patches get deferred, which assets sit outside an inventory, what a monitoring programme usually collects — are gone, because none of them could be sourced and each was load-bearing for the conclusion it supported.
+
 ## 0.19.30 — 2026-08-18
 
 Three CISA KEV entries join the catalog, taking it to 1,225. Each of them turns on a question its sources answer differently, which is why they landed a release later than the rest of their set.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-18T05:32:14.962Z",
+  "generated_at": "2026-08-19T19:44:10.894Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "81aa6acc7b57248f3efecb64f57223583366556ddbf2f8ede02677c4ae36b2b7",
+    "manifest.json": "18dc296b988a016e7750d51224ba1e047c8546286f0940d70b5c134f43b71cac",
     "README.md": "a757b8ed9923b7954518d00a768d338800460c9a90811094f050710fe9888615",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "4ac69e35dccb7a5f3eb3a8fefdfcb4ba5892345bddb5fa4d673ca6e336451ad8",
-    "data/cve-catalog.json": "c561377a52c2840f637e587175fa97c1ce96b35ad0431ec2491ecd63b70d29dd",
-    "data/cwe-catalog.json": "edfa10d0a1ade79c0cbc1ca928d0240e2d30b11302c453fed5cf440122d7424e",
+    "data/attack-techniques.json": "cf192b45621ce697d3b86789db58c840312c1fc13601beb58df7c747b065d08b",
+    "data/cve-catalog.json": "5baa25c6568864484499abfd3f6016dcd2efaacfd5fdc5105a70f5a51056461e",
+    "data/cwe-catalog.json": "7db3e297a7401c99e1bf9019e9b2eaf88e5cda97f6799e01667acab13362a746",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "927cf02d5ed3ec43a822e222a53f891ff0452e36fc5606b868e6dfc3f320e524",
+    "data/framework-control-gaps.json": "79cd66ea9ca6eb1e63c6647d52a28a205747d64c4cb96e61fb2bb0c057023834",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "7d06853a6a4b151620044190296a2e20b3d904333b5565863ecf1a75eb9e7c0a",
+    "data/zeroday-lessons.json": "a48c538ba1bb636fd2165768e9b045f0cf36ad23caa5fe451497a965649eaa1e",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1212,
+    "chains_cve_entries": 1310,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -6,7 +6,7 @@
   },
   "events": [
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/attack-techniques.json",
       "path": "data/attack-techniques.json",
@@ -14,15 +14,15 @@
       "entry_count": 794
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1225
+      "entry_count": 1323
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
@@ -30,7 +30,7 @@
       "entry_count": 236
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/framework-control-gaps.json",
       "path": "data/framework-control-gaps.json",
@@ -38,12 +38,12 @@
       "entry_count": 194
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1225
+      "entry_count": 1323
     },
     {
       "date": "2026-08-08",

package/data/_indexes/catalog-summaries.json

@@ -31,7 +31,7 @@
       "path": "data/attack-techniques.json",
       "purpose": null,
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-18",
+      "last_updated": "2026-08-19",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-18",
+      "last_updated": "2026-08-19",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,20 +62,20 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1225,
+      "entry_count": 1323,
       "sample_keys": [
-        "CVE-2010-5330",
-        "CVE-2022-21919",
-        "CVE-2022-22674",
-        "CVE-2007-3010",
-        "CVE-2014-0160"
+        "CVE-2005-2773",
+        "CVE-2009-0927",
+        "CVE-2009-1151",
+        "CVE-2009-2055",
+        "CVE-2010-2861"
       ]
     },
     "cwe-catalog.json": {
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-18",
+      "last_updated": "2026-08-19",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -163,7 +163,7 @@
       "path": "data/framework-control-gaps.json",
       "purpose": "Per-control framework gap declarations: SI-2, A.8.8, PCI 6.3.3, etc. Each entry names the control, the lag, the evidence CVE, and remediation guidance.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-18",
+      "last_updated": "2026-08-19",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-08-18",
+      "last_updated": "2026-08-19",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1225,
+      "entry_count": 1323,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",