@blamejs/exceptd-skills 0.19.36 → 0.19.38

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.19.38 — 2026-08-30
+
+A control requirement no longer argues from a premise that does not support it. The GNU InetUtils entry reasoned that because a patch exists and no live-patch path does, both a patch path and a service-disable path are available — which does not follow, since the absence of a live-patch path is not the presence of anything. A service-disable path does exist for that flaw, in CISA's required action, and the entry now says so from the field that carries it. What the two flags actually establish is the state the control exists to name: a fix that cannot be applied without interrupting the service, so the mitigation carries the risk while the patch is pending.
+
+A Chrome entry's attribution note ended with a stray quotation mark and comma — a fragment of the surrounding data format that escaped quoting during a bulk import years ago, leaving the field with an unclosed quotation. The delimiter is removed and the note's content is unchanged.
+
+## 0.19.37 — 2026-08-30
+
+The catalog reaches 1,517 CVEs with 100 additions from CISA KEV, spanning 2002 to 2026 — a third of them predate 2015, because KEV keeps listing defects whose disclosure is old and whose exploitation is current. Microsoft accounts for 33, Adobe 10, Oracle 8. Nineteen carry CISA's ransomware designation, 79 have an obtainable public exploit, and 47 need a restart before the fix is running. Eleven arrived with a remediation window of a week or less.
+
+Twenty-nine entries carry their CVE id in the title. CISA names a vulnerability by product and defect class rather than by defect, so one title covers entries decades apart — "Microsoft Windows Privilege Escalation Vulnerability" already sat on a 2021 record and now also fits a 2002 and a 2004 one. Where a title is shared, the identifier is appended so two entries are no longer indistinguishable in a list.
+
+Two entries record an exploit built with AI assistance rather than found with it. Cisco Talos documents the actor behind the AjaxPro deserialization flaw running PentestGPT to scan web servers and execute proof-of-concept exploits; the kernel container-escape entry rests on OpenAI's own report. Neither is an AI-discovered defect, and the entries say which side of that line they sit on.
+
+Where a KEV listing carries no vendor advisory, the entry says so rather than pointing somewhere plausible. Five of the additions have none to cite: the Nagios XI changelog names a sibling CVE and not the three listed here, WinRAR's only vendor reference is a rolling release-notes page that no longer mentions the defect, and Grandstream's advisory paths do not resolve. Thirteen advisories were attached to the remaining entries, each from the vendor or a coordinating body.
+
+Two entries state a companion defect's identifier that earlier drafts said did not exist. The TrueConf server code-injection flaw is remediated by the same upgrade as a missing-authentication flaw listed the same day, and that companion's deadline is eleven days earlier — an operator reading either entry now gets the deadline that actually binds the host.
+
 ## 0.19.36 — 2026-08-28
 
 The catalog describes findings again rather than the process that recorded them. Entries were written from a research bundle of facts, and that bundle's vocabulary reached the shipped prose: 1,691 sentences across 678 records opened with "the packet records", "the packet's affected list" or "packet facts for", naming an artefact no operator has ever seen. They now state the fact directly — "a vendor fix is available and there is no live-patch path" rather than "the packet records a vendor fix as available". Most sit in the control-requirement descriptions and their supporting evidence, with a few in exploitation and complexity notes.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-29T06:18:09.344Z",
+  "generated_at": "2026-08-30T16:48:30.616Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "9b93ad6ffcdecdbb039fb8de8fd73bc2289f6f0f55fb39ca4077f824e4646eb6",
+    "manifest.json": "b1bbfd14feb5f0dc0cc4afa5cf7100c6832a92ede0fb703ff769d327a4a63b1b",
     "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
-    "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "2179122ff8347bc691f245d5fd2601ca81fd1d6f790feae44abca86d3c08f865",
-    "data/cve-catalog.json": "ea4f8d911c00a68c2510eada2b82216ae3d25ba6569814e96dc525d2e0df54fa",
-    "data/cwe-catalog.json": "b1e0db672d1de7cb3d36cac05059f0302b3be4f88636e6beb47d57ec0d972928",
+    "data/atlas-ttps.json": "09c4fa9bfedca16747f56a05ae296c820c1e99f5643f9da59e6871014ac057d1",
+    "data/attack-techniques.json": "00312ce7b17c9df7cdc94f1aaf668fc9e891c25f9b14c650707f65c11e6677d7",
+    "data/cve-catalog.json": "cd55cc402d63ef8b29402412c6399d9c07647d206903dc667a79c35f33303ff4",
+    "data/cwe-catalog.json": "e8d9741fae3938a7cc078832f9c5fba8e864809c6b6eb998fd8ba0a6fcd69ad4",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "5d407cd31e4cdbc34fe37253c374488158d7c15f597158930b4ac9729e666bb3",
+    "data/framework-control-gaps.json": "a5c8378d53886252cfcfd319de46c4ceadce2e3511f810d2e9dbf94cf6b252f7",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "818a8f588b6c31e820c616519a7a7cffec69f44e31c2690658f986384b8e989f",
+    "data/zeroday-lessons.json": "2ecddeaaea1f5883132e009a168046eb88807cddde14310410b31df43cda42b4",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1404,
+    "chains_cve_entries": 1504,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1417
+      "entry_count": 1517
     },
     {
       "date": "2026-08-19",
@@ -43,7 +43,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1417
+      "entry_count": 1517
     },
     {
       "date": "2026-08-08",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1417,
+      "entry_count": 1517,
       "sample_keys": [
-        "CVE-2018-8373",
-        "CVE-2019-1132",
-        "CVE-2019-1129",
-        "CVE-2019-1069",
-        "CVE-2019-1064"
+        "CVE-2023-49105",
+        "CVE-2026-53362",
+        "CVE-2026-66384",
+        "CVE-2021-23758",
+        "CVE-2015-3246"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1417,
+      "entry_count": 1517,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",