@blamejs/exceptd-skills 0.19.6 → 0.19.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/_indexes/activity-feed.json +8 -8
- package/data/_indexes/catalog-summaries.json +1 -1
- package/data/zeroday-lessons.json +1784 -67
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +18 -18
- package/scripts/release.js +19 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.7 — 2026-08-09
|
|
4
|
+
|
|
5
|
+
Another 66 CVEs report the controls they require, taking coverage to 424 of 1025. The set reaches beyond appliances into Roundcube and Zimbra webmail, SmarterMail, WatchGuard Firebox, VMware Aria Operations, GitLab, Vite, Windows NTFS, FreePBX and the Apple and Ivanti mobile estate.
|
|
6
|
+
|
|
7
|
+
Two requirements dominate where the affected asset manages other assets. A device-management gateway reached before authentication is a fleet event rather than a host event: the vendor fix closes the injection path but leaves every configuration profile pushed, certificate issued and credential that transited the server untouched, so the requirement covers revoking what the server issued and invalidating device trust state, not just installing the update. And on a mobile estate the operative failure is deferral — an update prompt dismissed on a personally-carried device extends exposure to a confirmed-exploited kernel flaw for weeks while the console still reports the fleet as managed — so the requirement is enforcement with a deadline and loss of access past it, not a patch-level report.
|
|
8
|
+
|
|
9
|
+
Entries state their own limits. Where a control bounds the damage without preventing the flaw, it says so rather than implying prevention; where the vendor ships no fix, the requirement describes the compensating control instead of a patch window.
|
|
10
|
+
|
|
3
11
|
## 0.19.6 — 2026-08-08
|
|
4
12
|
|
|
5
13
|
Another 48 CVEs report the controls they require, taking the catalog to 358 of 1025. The set spans SharePoint and SolarWinds Web Help Desk deserialization, Samsung MagicINFO and SimpleHelp path traversal, Fortinet FortiClient EMS, Ivanti Endpoint Manager, CRI-O and containerd, and the Apple and Chromium memory-safety entries.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-09T10:13:44.639Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "25e19ace806ba31cd59aa023427d4969fc610c0cd039f51f49aa7bba8836a5f4",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "fdd6944844660d6057c531c3046b3f7bb665260c1986c82a9b9755eeb6d93e56",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|
|
@@ -5,6 +5,14 @@
|
|
|
5
5
|
"event_count": 63
|
|
6
6
|
},
|
|
7
7
|
"events": [
|
|
8
|
+
{
|
|
9
|
+
"date": "2026-08-09",
|
|
10
|
+
"type": "catalog_update",
|
|
11
|
+
"artifact": "data/zeroday-lessons.json",
|
|
12
|
+
"path": "data/zeroday-lessons.json",
|
|
13
|
+
"schema_version": "1.1.0",
|
|
14
|
+
"entry_count": 1025
|
|
15
|
+
},
|
|
8
16
|
{
|
|
9
17
|
"date": "2026-08-08",
|
|
10
18
|
"type": "catalog_update",
|
|
@@ -29,14 +37,6 @@
|
|
|
29
37
|
"schema_version": "1.0.0",
|
|
30
38
|
"entry_count": 1025
|
|
31
39
|
},
|
|
32
|
-
{
|
|
33
|
-
"date": "2026-08-08",
|
|
34
|
-
"type": "catalog_update",
|
|
35
|
-
"artifact": "data/zeroday-lessons.json",
|
|
36
|
-
"path": "data/zeroday-lessons.json",
|
|
37
|
-
"schema_version": "1.1.0",
|
|
38
|
-
"entry_count": 1025
|
|
39
|
-
},
|
|
40
40
|
{
|
|
41
41
|
"date": "2026-08-06",
|
|
42
42
|
"type": "catalog_update",
|
|
@@ -229,7 +229,7 @@
|
|
|
229
229
|
"path": "data/zeroday-lessons.json",
|
|
230
230
|
"purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
|
|
231
231
|
"schema_version": "1.1.0",
|
|
232
|
-
"last_updated": "2026-08-
|
|
232
|
+
"last_updated": "2026-08-09",
|
|
233
233
|
"tlp": "CLEAR",
|
|
234
234
|
"source_confidence_default": "B2",
|
|
235
235
|
"freshness_policy": {
|