@blamejs/exceptd-skills 0.19.35 → 0.19.37

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.19.37 — 2026-08-30
+
+The catalog reaches 1,517 CVEs with 100 additions from CISA KEV, spanning 2002 to 2026 — a third of them predate 2015, because KEV keeps listing defects whose disclosure is old and whose exploitation is current. Microsoft accounts for 33, Adobe 10, Oracle 8. Nineteen carry CISA's ransomware designation, 79 have an obtainable public exploit, and 47 need a restart before the fix is running. Eleven arrived with a remediation window of a week or less.
+
+Twenty-nine entries carry their CVE id in the title. CISA names a vulnerability by product and defect class rather than by defect, so one title covers entries decades apart — "Microsoft Windows Privilege Escalation Vulnerability" already sat on a 2021 record and now also fits a 2002 and a 2004 one. Where a title is shared, the identifier is appended so two entries are no longer indistinguishable in a list.
+
+Two entries record an exploit built with AI assistance rather than found with it. Cisco Talos documents the actor behind the AjaxPro deserialization flaw running PentestGPT to scan web servers and execute proof-of-concept exploits; the kernel container-escape entry rests on OpenAI's own report. Neither is an AI-discovered defect, and the entries say which side of that line they sit on.
+
+Where a KEV listing carries no vendor advisory, the entry says so rather than pointing somewhere plausible. Five of the additions have none to cite: the Nagios XI changelog names a sibling CVE and not the three listed here, WinRAR's only vendor reference is a rolling release-notes page that no longer mentions the defect, and Grandstream's advisory paths do not resolve. Thirteen advisories were attached to the remaining entries, each from the vendor or a coordinating body.
+
+Two entries state a companion defect's identifier that earlier drafts said did not exist. The TrueConf server code-injection flaw is remediated by the same upgrade as a missing-authentication flaw listed the same day, and that companion's deadline is eleven days earlier — an operator reading either entry now gets the deadline that actually binds the host.
+
+## 0.19.36 — 2026-08-28
+
+The catalog describes findings again rather than the process that recorded them. Entries were written from a research bundle of facts, and that bundle's vocabulary reached the shipped prose: 1,691 sentences across 678 records opened with "the packet records", "the packet's affected list" or "packet facts for", naming an artefact no operator has ever seen. They now state the fact directly — "a vendor fix is available and there is no live-patch path" rather than "the packet records a vendor fix as available". Most sit in the control-requirement descriptions and their supporting evidence, with a few in exploitation and complexity notes.
+
+Comparisons that only held inside the run that produced them are gone rather than reworded. A record saying an entry carried "the highest RWEP in this batch" or "the lowest base score of this batch" was ranking it against a set the reader cannot enumerate, so the ranking goes and the standalone claim stays. No replacement comparison was invented in its place.
+
+Where a sentence scoped a negative finding to the moment it was written — "no campaign was attributed during this curation" — the limit is kept and restated about the record: no public report attributes one. Dropping the clause outright would have promoted "nothing was found" to "nothing exists", which is a stronger claim than the evidence supports.
+
+Attack timelines keep their own numbering. The Shai-Hulud worm's four phases and the Moika dependency-confusion campaign's publishing waves describe the attack, and an IKE phase-1 negotiation is where in the protocol a defect sits; all are subject matter and are untouched.
+
 ## 0.19.35 — 2026-08-25
 
 A scan that could not read something no longer reports that it found nothing there. The evidence collectors treated an unreadable file the same as an absent one: a credential store over the size cap, a workflow file without read permission, a lockfile that failed to parse all produced the output of a clean scan. A credential store that exists but went unread now reports its indicator as inconclusive rather than a miss, and its artifact as uncaptured with the reason attached. An unparseable Google Cloud credentials file reports the same way, since a parse that failed says nothing about what the file holds. A file read successfully but empty stays a completed scan, because the collector did read it and there was nothing in it — the two cases were previously indistinguishable, and both read as clean.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-25T14:19:57.183Z",
+  "generated_at": "2026-08-30T13:29:34.473Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "ec8d77f3c80b458eeb5901346be0e0f8fde9903da2de9ed85740372beddb8261",
+    "manifest.json": "a92cc16a7f17121273701c76dbc50d46df3175b55aa707948dd1ffd0d94c8327",
     "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
-    "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "2179122ff8347bc691f245d5fd2601ca81fd1d6f790feae44abca86d3c08f865",
-    "data/cve-catalog.json": "cac36e318f4ab524f8c578180fcedf32d2cb9a12fa541be876162975806be7cf",
-    "data/cwe-catalog.json": "b1e0db672d1de7cb3d36cac05059f0302b3be4f88636e6beb47d57ec0d972928",
+    "data/atlas-ttps.json": "09c4fa9bfedca16747f56a05ae296c820c1e99f5643f9da59e6871014ac057d1",
+    "data/attack-techniques.json": "00312ce7b17c9df7cdc94f1aaf668fc9e891c25f9b14c650707f65c11e6677d7",
+    "data/cve-catalog.json": "4577bceadf71d30f4abce3e36050296399cd6f35a2616399215e23e09572b20c",
+    "data/cwe-catalog.json": "e8d9741fae3938a7cc078832f9c5fba8e864809c6b6eb998fd8ba0a6fcd69ad4",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "5d407cd31e4cdbc34fe37253c374488158d7c15f597158930b4ac9729e666bb3",
+    "data/framework-control-gaps.json": "a5c8378d53886252cfcfd319de46c4ceadce2e3511f810d2e9dbf94cf6b252f7",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "fbf03302ccf8f758f00541ce0e21b5ae6980eac8357564fe5825a09ddf0b4c18",
+    "data/zeroday-lessons.json": "8c36024218e83f003ea28269f49b061bacb4f8ad49a6cf4d452229745705c70c",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1404,
+    "chains_cve_entries": 1504,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1417
+      "entry_count": 1517
     },
     {
       "date": "2026-08-19",
@@ -43,7 +43,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1417
+      "entry_count": 1517
     },
     {
       "date": "2026-08-08",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1417,
+      "entry_count": 1517,
       "sample_keys": [
-        "CVE-2018-8373",
-        "CVE-2019-1132",
-        "CVE-2019-1129",
-        "CVE-2019-1069",
-        "CVE-2019-1064"
+        "CVE-2023-49105",
+        "CVE-2026-53362",
+        "CVE-2026-66384",
+        "CVE-2021-23758",
+        "CVE-2015-3246"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1417,
+      "entry_count": 1517,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",