@blamejs/exceptd-skills 0.21.0 → 0.21.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.21.1 — 2026-09-23
+
+The catalog holds 1,720 CVEs after four additions from CISA KEV. Three are Linux kernel flaws CISA listed on 18 September 2026: the AF_ALG crypto interface race (CVE-2025-39964), the kernel TLS receive-path flaw (CVE-2025-39682) and the ebtables SNAT out-of-bounds write (CVE-2026-53266). The fourth is the Zyxel GS1900 switch web management overflow (CVE-2026-7273), listed on 21 September.
+
+CISA marks all four for forensic triage under BOD 26-04. Each entry records the flag and says to check exposed hosts and switches for compromise, not only to patch them.
+
+The kernel entries give the fixed build for each distribution and product line they name, among them Red Hat, SUSE, Debian, Ubuntu, Google Container-Optimized OS and Siemens. Compare a distribution kernel by its package version or image build: a patched distribution kernel can report a `uname -r` version inside the upstream affected range. The kernel TLS entry lists the SUSE Linux Enterprise 15 SP6 and SP7 live patches, which apply the fix without a reboot.
+
+Four entries now include their CVE id in the title, because CISA names these flaws by product and defect class and the same name already covered another record: the new AF_ALG and ebtables entries, and the existing CVE-2014-0196 and CVE-2024-53104 entries whose names they share.
+
 ## 0.21.0 — 2026-09-23
 
 Australian ISM citations now name the controls they describe. Most ISM control numbers in the catalog, the framework-gap registry, the skills and the playbooks pointed at a different control from the one the surrounding text described. ISM-1546, which 207 entries cited as the patching control, requires users to be authenticated before they are granted access to a system. ISM-1556, ISM-1559 and ISM-1808 were also cited for obligations they do not contain. Every citation was checked against the OSCAL catalog ASD publishes for ISM release 2026.09.4. Each citation now names the control whose statement matches the claim, or it was removed where no control makes that claim.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-23T08:58:56.658Z",
+  "generated_at": "2026-09-23T15:55:32.332Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "bd60904ccc4042aaa0063e4025a58ced6f29873773623871671328b9b3b624ae",
+    "manifest.json": "ac62cce28a6cf5ac86b068772c49be774ab1b3fb71eb8f7f2c840279257cf996",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "e7498b7ad3582154184eb08f71f6690e2fea37e3fdee6c8a83b26879da2b0d50",
-    "data/cve-catalog.json": "210d9c3102122a7feb76747de31a48d61176bdc7f6e9dd7dbe5a8e6a980aba02",
-    "data/cwe-catalog.json": "173b4803d5d3bc57723a036c3740c72647a10eb24dbf1502e254e12c91b715bc",
+    "data/attack-techniques.json": "b77468556136a97de0c081633ece85a135487dbf18fc70c3b5ff04c34fa3956e",
+    "data/cve-catalog.json": "b4d65c53a1952641b2fc2be0d3fd830ad11a2866c7d8766ad4dde33909bf12e3",
+    "data/cwe-catalog.json": "10161a298d27b9e0127198651d2eda7d8514a085d55fa6181106e2c8085f05c4",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "b60e4731a19f496775e1651dc6320b52212db5d79b0c3e88b78f967d49248f9d",
+    "data/framework-control-gaps.json": "d80e39cfb44c7144f70ab5c695f802274c99af0e550722ea8b0cf66d2d03537b",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "b522bf407207ca0161f2bd6885d34ed0a623bdab7b9817b5a1136f82c25fc5f1",
+    "data/zeroday-lessons.json": "829cb48af805b1ed20867756c14a40a399e506c9fed5c413c2cb74ecb52d24c5",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1703,
+    "chains_cve_entries": 1707,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -258,7 +258,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1716
+      "entry_count": 1720
     },
     {
       "date": "2026-08-19",
@@ -282,7 +282,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1716
+      "entry_count": 1720
     },
     {
       "date": "2026-08-05",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1716,
+      "entry_count": 1720,
       "sample_keys": [
-        "CVE-2026-19490",
-        "CVE-2019-11634",
-        "CVE-2026-84869",
-        "CVE-2020-29557",
-        "CVE-2020-5902"
+        "CVE-2026-53266",
+        "CVE-2025-39964",
+        "CVE-2026-7273",
+        "CVE-2025-39682",
+        "CVE-2026-19490"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1716,
+      "entry_count": 1720,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 35647502 bytes
-sha256: e8e80d4de3f945407de1ac45aeaaf780851a8b9edae1e4ca4579253c73894a8e
+size: 35725516 bytes
+sha256: 47f44e5212c7e924cf55dc4fedf6996a0051fae181c20d1f4c8405ea908320b0

package/data/attack-techniques.json

@@ -1043,6 +1043,8 @@
       "CVE-2025-32709",
       "CVE-2025-33073",
       "CVE-2025-38352",
+      "CVE-2025-39682",
+      "CVE-2025-39964",
       "CVE-2025-40602",
       "CVE-2025-41244",
       "CVE-2025-43300",
@@ -1073,6 +1075,7 @@
       "CVE-2026-46300",
       "CVE-2026-46333",
       "CVE-2026-48172",
+      "CVE-2026-53266",
       "CVE-2026-53362",
       "CVE-2026-54420",
       "CVE-2026-56155",
@@ -2589,6 +2592,7 @@
       "CVE-2026-6973",
       "CVE-2026-72529",
       "CVE-2026-72530",
+      "CVE-2026-7273",
       "CVE-2026-72898",
       "CVE-2026-73570",
       "CVE-2026-7473",
@@ -3677,6 +3681,7 @@
       "CVE-2026-21962",
       "CVE-2026-30615",
       "CVE-2026-60004",
+      "CVE-2026-7273",
       "CVE-2026-8452",
       "CVE-2026-85706",
       "MAL-2026-3083",
@@ -4350,6 +4355,7 @@
       "CVE-2025-22226",
       "CVE-2025-23266",
       "CVE-2025-38352",
+      "CVE-2025-39964",
       "CVE-2026-53362"
     ],
     "description_full": "Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview) There are multiple ways an adversary may escape from a container to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask) Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open) In ESXi environments, an adversary may exploit a vulnerability in order to escape from a virtual machine into the hypervisor.(Citation: Broadcom VMSA-2025-004) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers or virtual machines running on the host, or setting up a command and control channel on the host.",
@@ -6430,6 +6436,7 @@
       "CVE-2024-55956",
       "CVE-2024-9680",
       "CVE-2026-34486",
+      "CVE-2026-7273",
       "CVE-2026-75650",
       "CVE-2026-81578",
       "CVE-2026-82078",
@@ -7219,6 +7226,7 @@
       "CVE-2024-12356",
       "CVE-2024-38812",
       "CVE-2024-38813",
+      "CVE-2025-39682",
       "CVE-2026-34486",
       "CVE-2026-83548"
     ]
@@ -11834,6 +11842,7 @@
       "CVE-2026-34486",
       "CVE-2026-49869",
       "CVE-2026-60004",
+      "CVE-2026-7273",
       "CVE-2026-73570",
       "CVE-2026-76460",
       "CVE-2026-76461",
@@ -15304,6 +15313,8 @@
       "CVE-2021-22991",
       "CVE-2021-27562",
       "CVE-2021-31166",
+      "CVE-2025-39682",
+      "CVE-2025-39964",
       "CVE-2026-20349",
       "CVE-2026-67277"
     ]
@@ -21360,7 +21371,8 @@
     "cve_refs": [
       "CVE-2018-0171",
       "CVE-2022-40684",
-      "CVE-2026-20079"
+      "CVE-2026-20079",
+      "CVE-2026-7273"
     ]
   },
   "T1608.001": {