@blamejs/exceptd-skills 0.19.32 → 0.19.33

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.19.33 — 2026-08-23
+
+The catalog reaches 1,417 CVEs with 94 additions from CISA KEV, weighted to the years the vendors in question were shipping fastest: 25 from 2017, 18 from 2018, 11 from 2015, and ten each from 2016 and 2019. Cisco accounts for 38, Microsoft 28 and Adobe 12. Sixteen carry CISA's ransomware designation, 42 have an obtainable public exploit, and 61 need a restart before the fix is running — the entries keep that separate from the update being installed, because a remediation record keyed to the deployed version reports a host as done while the pre-patch code is still executing.
+
+Thirty-eight of the additions are Cisco IOS and IOS XE advisories, and most of them publish no fixed-release table. Cisco routes operators to its Software Checker, which answers per image and per train rather than per CVE, so those entries name the Checker and the Cisco bug ID as the lookup key instead of a version number. Where a version boundary does exist it is recorded; where one does not, the entry says so rather than inventing one. The same advisories share bug IDs across CVEs without publishing a per-CVE mapping, and for the nine SNMP entries that means a single configuration change — dropping the MIB view exclusion — reopens all of them at once.
+
+Where sources disagree, the entries carry the disagreement. Microsoft's record for CVE-2019-1297 still rates exploitation less likely while CISA listed it as exploited two and a half years later, and the entry states both rather than resolving them. Cisco's advisory for CVE-2018-0151 has not been revised since 2018 and says its response team is unaware of malicious use, while CISA lists it; the entry scopes its remediation trigger to the KEV listing and records the vendor's position beside it. NVD and Cisco score CVE-2018-0161 differently on attack complexity, and neither publishes the device state that would explain the gap, so both vectors are reported.
+
+Twenty-one entries carry a weakness assigned editorially, and each says so in its attribution along with the reason. Thirteen are CVEs for which NVD published no weakness at all. The other eight are ones where NVD published only CWE-399, a category MITRE prohibits in that position: those name the real weakness the mechanism implies — an unbounded MAC table is a resource-allocation failure, an SNMP walk that pins the CPU is uncontrolled consumption — rather than repeating a classification that resolves to nothing.
+
+Framework-gap statements are written from each CVE's own dates, versions and vendor wording. Claims about what organisations typically do — which patches get deferred, what a monitoring programme usually collects, how much of an estate runs a given configuration — are absent, because none of them could be sourced and each was load-bearing for the conclusion it supported. Where a standard's text carries the argument it is quoted; where the standard could not be reached, the argument rests on something that could.
+
 ## 0.19.32 — 2026-08-21
 
 A KEV entry stores four fields from CISA's record and the refresh compared two of them. The listing flag and its date tracked upstream; the remediation deadline and the ransomware designation were written once, at curation, and never looked at again. Both now reconcile on every refresh, on the live path and the cached one alike, which closes a gap that had been widening since the fields were first stored.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-22T06:16:21.493Z",
+  "generated_at": "2026-08-23T07:03:41.141Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "0b5994038838da7f7685f50c81eb5dc9c552c3865617162bab778279ed9bacbe",
+    "manifest.json": "ab7c042636d0c7d610957171d74bd4e0973d8f5718315c90488333a824444a77",
     "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "cf192b45621ce697d3b86789db58c840312c1fc13601beb58df7c747b065d08b",
-    "data/cve-catalog.json": "8293de3334f8c134c26b13269126c62ed80fc88663a4e45d456beb031b8893e4",
-    "data/cwe-catalog.json": "7db3e297a7401c99e1bf9019e9b2eaf88e5cda97f6799e01667acab13362a746",
+    "data/attack-techniques.json": "2179122ff8347bc691f245d5fd2601ca81fd1d6f790feae44abca86d3c08f865",
+    "data/cve-catalog.json": "cac36e318f4ab524f8c578180fcedf32d2cb9a12fa541be876162975806be7cf",
+    "data/cwe-catalog.json": "b1e0db672d1de7cb3d36cac05059f0302b3be4f88636e6beb47d57ec0d972928",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "79cd66ea9ca6eb1e63c6647d52a28a205747d64c4cb96e61fb2bb0c057023834",
+    "data/framework-control-gaps.json": "5d407cd31e4cdbc34fe37253c374488158d7c15f597158930b4ac9729e666bb3",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "3ee0c1aa27701a0eda2479f0d10fb4f095d8d542152595a04b15373eddf69d1e",
+    "data/zeroday-lessons.json": "fbf03302ccf8f758f00541ce0e21b5ae6980eac8357564fe5825a09ddf0b4c18",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1310,
+    "chains_cve_entries": 1404,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1323
+      "entry_count": 1417
     },
     {
       "date": "2026-08-19",
@@ -43,7 +43,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1323
+      "entry_count": 1417
     },
     {
       "date": "2026-08-08",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1323,
+      "entry_count": 1417,
       "sample_keys": [
-        "CVE-2005-2773",
-        "CVE-2009-0927",
-        "CVE-2009-1151",
-        "CVE-2009-2055",
-        "CVE-2010-2861"
+        "CVE-2018-8373",
+        "CVE-2019-1132",
+        "CVE-2019-1129",
+        "CVE-2019-1069",
+        "CVE-2019-1064"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1323,
+      "entry_count": 1417,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",