@blamejs/exceptd-skills 0.19.9 → 0.19.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/data/_indexes/_meta.json +3 -3
- package/data/_indexes/activity-feed.json +1 -1
- package/data/_indexes/catalog-summaries.json +1 -1
- package/data/zeroday-lessons.json +1004 -40
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +16 -16
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.19.10 — 2026-08-10
|
|
4
|
+
|
|
5
|
+
Another 39 CVEs report the controls they require, taking coverage to 538 of 1025. The set includes the WSUS deserialization flaw, Grafana and Roundcube, Quest KACE, Samsung mobile, Chromium ANGLE, and the QNAP Pwn2Own chain.
|
|
6
|
+
|
|
7
|
+
Two of these state something the patch-cadence controls cited against them do not. The WSUS entry inverts the usual remediation order: the update server has to be fixed ahead of the endpoints it serves, because an unauthenticated path to code execution on it reaches every host that trusts it for updates. And the QNAP chain components carry no KEV listing and no confirmed exploitation, so a listing-triggered clock never starts for them — a working exploit chain was demonstrated publicly regardless, and each component scored on its own severity understates what the chain composes into. The entry says so rather than attaching a control whose trigger condition is absent.
|
|
8
|
+
|
|
9
|
+
Requirements that bound reachability now state what they do not do. A management-surface isolation limits who can reach a command-injection sink; it does not remove the sink, does nothing against an attacker already inside the segment, and does not substitute for the firmware update. Recording the condition is what stops a compensating control being logged as remediation while the path stays reachable.
|
|
10
|
+
|
|
3
11
|
## 0.19.9 — 2026-08-09
|
|
4
12
|
|
|
5
13
|
Another 38 CVEs report the controls they require, taking coverage to 499 of 1025 — roughly half the catalog. The set spans Laravel Livewire and SolarWinds Web Help Desk, Adobe Commerce, PaperCut, WinRAR, PHPMailer, Ubiquiti UniFi OS, Zimbra, and Windows and Linux kernel entries.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-08-
|
|
3
|
+
"generated_at": "2026-08-10T08:23:07.594Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "fcbab7f9fd9701927a2c9fe8935011447a4ca1c2d1591c2bdb0c34ad4e583135",
|
|
8
8
|
"README.md": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa",
|
|
9
9
|
"data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
|
|
10
10
|
"data/attack-techniques.json": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
"data/framework-control-gaps.json": "a0a43cd0c8fff6ca753bb2c98f121922ff3de63102b7d67c86c76037e28cd553",
|
|
17
17
|
"data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "2a27275b496d5a0b791148cf4cabd1df94b0cca7842b9664e6bac9809e6b9195",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
|
|
@@ -229,7 +229,7 @@
|
|
|
229
229
|
"path": "data/zeroday-lessons.json",
|
|
230
230
|
"purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
|
|
231
231
|
"schema_version": "1.1.0",
|
|
232
|
-
"last_updated": "2026-08-
|
|
232
|
+
"last_updated": "2026-08-10",
|
|
233
233
|
"tlp": "CLEAR",
|
|
234
234
|
"source_confidence_default": "B2",
|
|
235
235
|
"freshness_policy": {
|