@blamejs/exceptd-skills 0.19.38 → 0.19.39

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.19.39 — 2026-09-04
+
+The catalog now holds 1,617 CVEs after 100 additions from CISA KEV, concentrated in 2021 — 47 of them — with 17 each from 2019 and 2020 and the oldest reaching back to 2010. Apple accounts for 23, Apache 12, Microsoft and Cisco 6 each. Twenty-four have CISA's ransomware designation, 62 have an obtainable public exploit, and 51 need a restart before the fix is running.
+
+Twenty-three entries now include their CVE id in the title. CISA names a vulnerability by product and defect class rather than by defect, so "Apple Multiple Products Code Execution Vulnerability" was already the title of two shipped records and would have fitted a third; where a title is shared, the identifier is appended so an operator searching the catalog no longer gets rows they cannot tell apart.
+
+Where a listing has no vendor advisory to cite, the entry says so instead of linking something plausible. Twenty-one advisories were added across fourteen entries, each read rather than inferred — Red Hat errata, an Apache Struts bulletin, Apple's per-platform security notes, a CERT/CC vulnerability note, a vendor release note naming the fixed build. Three of them cite vendor material that describes the flaw, the affected range and the fixed version without printing the CVE number; the entry says which three.
+
+Fourteen entries record a weakness assigned editorially because NVD published none, each naming the mechanism it is based on. Six of the fourteen use a broader classification than the rest, because the vendor publishes nothing finer — Apple describes several of these only as addressed with improved restrictions, and a narrower weakness would assert more than the record supports.
+
+The Log4j entry's remediation no longer offers a mitigation that does nothing on the releases it is offered for. Setting the message-lookup property is an alternative only from 2.10.0 onward; on an affected release older than that the property is read by nothing, so an operator who set it and restarted was left exactly as exposed. Removing the lookup class from the deployed jar works across the whole affected range and is now listed first. The upgrade target has changed too: the entry named three follow-on defects and then told operators to install a release that closes only the first of them.
+
+Four more records misdirected the work they describe. The Accellion FTA command-execution entry said a single build closed the whole exploited chain; it closes two of the four, and the entry now separates this defect's fixed build from the one the joint advisory directs operators to. The Apache 2.4.49 traversal entry told operators to watch for POST requests to a CGI path, while the Metasploit module for it sends a randomly generated method — a rule built from that guidance never fires on it — and every indicator on the entry now names the published exploit it was read from, down to the request paths and the response matcher. A PaperCut host running the emergency build was recorded as running a mitigation with no patch behind it, which is the state its own control reserves for a host that has no build to install; the entry now says the build is a patch and that the vendor still owes a fully tested replacement for it, rather than treating the second fact as cancelling the first. And two scoring notes explained a score their factors no longer produce, one of them still deducting for a live patch the entry had withdrawn.
+
+Detection indicators now say where they came from. On the 62 new entries with an obtainable public exploit, each group of indicators names the template, module or advisory it was read from, with a link, and says outright which items are hunting heuristics rather than artifacts anyone observed — 66% of them cite a source that was fetched and read, against 32% across the rest of the catalog. Reading those sources changed 55 indicators and added 84. The recurring correction is an indicator that named one HTTP method or one fixed path where the published detection rule varies it, which produces a rule that never fires on the exploit it was written for: the Zimbra Autodiscover path is matched case-insensitively because the public module uses a different form, the Struts endpoint indicator no longer names a single action, and three entries now warn against keying on the method at all. Where no source could be reached, the entry says so instead of implying one.
+
 ## 0.19.38 — 2026-08-30
 
 A control requirement no longer argues from a premise that does not support it. The GNU InetUtils entry reasoned that because a patch exists and no live-patch path does, both a patch path and a service-disable path are available — which does not follow, since the absence of a live-patch path is not the presence of anything. A service-disable path does exist for that flaw, in CISA's required action, and the entry now says so from the field that carries it. What the two flags actually establish is the state the control exists to name: a fix that cannot be applied without interrupting the service, so the mitigation carries the risk while the patch is pending.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-30T16:48:30.616Z",
+  "generated_at": "2026-09-05T04:29:33.248Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "b1bbfd14feb5f0dc0cc4afa5cf7100c6832a92ede0fb703ff769d327a4a63b1b",
+    "manifest.json": "919027cb04c69bd4d8c629e150772e25468b4acd9828e4a973caac8513b6d3ed",
     "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
     "data/atlas-ttps.json": "09c4fa9bfedca16747f56a05ae296c820c1e99f5643f9da59e6871014ac057d1",
-    "data/attack-techniques.json": "00312ce7b17c9df7cdc94f1aaf668fc9e891c25f9b14c650707f65c11e6677d7",
-    "data/cve-catalog.json": "cd55cc402d63ef8b29402412c6399d9c07647d206903dc667a79c35f33303ff4",
-    "data/cwe-catalog.json": "e8d9741fae3938a7cc078832f9c5fba8e864809c6b6eb998fd8ba0a6fcd69ad4",
+    "data/attack-techniques.json": "77de50423e49525e8ce99ff8c3758e11f68d1e0850e0591a4175edc058addac9",
+    "data/cve-catalog.json": "644ceaca7b05c74c905082be18897d81341126da02bbeda75cb6722734a18863",
+    "data/cwe-catalog.json": "1c5401f7d60070e6dd8556ce5cafd14aab989d59360a627443b371cc6b50991b",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "a5c8378d53886252cfcfd319de46c4ceadce2e3511f810d2e9dbf94cf6b252f7",
+    "data/framework-control-gaps.json": "522444f698e7915435ceee9f056ab021a11e6875d123c2b8897413401d2b06fa",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "2ecddeaaea1f5883132e009a168046eb88807cddde14310410b31df43cda42b4",
+    "data/zeroday-lessons.json": "4b5d0b4d92175307cc7f9c9faf003b337a5ff35d44a54c7bc2b1a686abba6db9",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1504,
+    "chains_cve_entries": 1604,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1517
+      "entry_count": 1617
     },
     {
       "date": "2026-08-19",
@@ -43,7 +43,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1517
+      "entry_count": 1617
     },
     {
       "date": "2026-08-08",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1517,
+      "entry_count": 1617,
       "sample_keys": [
-        "CVE-2023-49105",
-        "CVE-2026-53362",
-        "CVE-2026-66384",
-        "CVE-2021-23758",
-        "CVE-2015-3246"
+        "CVE-2026-82078",
+        "CVE-2026-81578",
+        "CVE-2021-36260",
+        "CVE-2020-6572",
+        "CVE-2019-1458"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1517,
+      "entry_count": 1617,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",