@blamejs/exceptd-skills 0.21.1 → 0.21.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +17 -0
- package/data/_indexes/_meta.json +5 -5
- package/data/cve-catalog.json +421 -401
- package/data/exploit-availability.json +8 -8
- package/data/zeroday-lessons.json +969 -669
- package/lib/cve-batch.js +10 -2
- package/lib/cve-enrich.js +2 -2
- package/lib/schemas/cve-catalog.schema.json +1 -1
- package/lib/validate-cve-catalog.js +27 -0
- package/manifest.json +53 -53
- package/package.json +1 -1
- package/sbom.cdx.json +27 -27
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,22 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.21.2 — 2026-09-23
|
|
4
|
+
|
|
5
|
+
`ai_discovery_source` now records who found each vulnerability, and every catalog entry and its zero-day lesson carry the same value. The affected product's own vendor or project team is `vendor_research`. An outside researcher, security company, incident responder or bug-bounty reporter, named or anonymous, is `human_researcher`, or `bug_bounty_ai_augmented` when AI tooling found the flaw. `unknown` means no source identifies who found or reported the flaw.
|
|
6
|
+
|
|
7
|
+
389 entries changed, each decided from its own discovery notes:
|
|
8
|
+
|
|
9
|
+
- 255 that credit an outside researcher or company with finding the flaw, or with reporting it or its exploitation in the wild to the vendor, moved from `vendor_research` to `human_researcher`. CVE-2020-15415, which credits the CLP-team researcher group, is one of them.
|
|
10
|
+
- 87 that name no finder moved from `vendor_research` to `unknown`.
|
|
11
|
+
- The 20 entries that had no value now have one.
|
|
12
|
+
- Five AI-found entries credited to an outside company's AI system moved to `bug_bounty_ai_augmented`: Horizon3, GreyNoise, CERT Polska, and Google's Big Sleep on SQLite and on FFmpeg.
|
|
13
|
+
- Four entries with `ai_discovered` false that carried an AI-only value now read `human_researcher`.
|
|
14
|
+
- 18 others were corrected from their notes, among them six whose notes credit an anonymous outside reporter, which moved from `unknown` to `human_researcher`.
|
|
15
|
+
|
|
16
|
+
668 lessons were updated to match their catalog entry, and the eight exploit-availability records whose value differed now match their catalog entry. Discovery notes that stated a value the entry does not hold were corrected.
|
|
17
|
+
|
|
18
|
+
Batch curation now records `unknown` when a judgment names no finder, instead of `vendor_research`, and fills a lesson's value from its entry. The catalog validator reports an AI-only value on an entry whose `ai_discovered` is not true, `human_researcher` on an AI-discovered entry, and a lesson whose value differs from its catalog entry. Under `--strict`, which the pre-publish gate uses, each is an error.
|
|
19
|
+
|
|
3
20
|
## 0.21.1 — 2026-09-23
|
|
4
21
|
|
|
5
22
|
The catalog holds 1,720 CVEs after four additions from CISA KEV. Three are Linux kernel flaws CISA listed on 18 September 2026: the AF_ALG crypto interface race (CVE-2025-39964), the kernel TLS receive-path flaw (CVE-2025-39682) and the ebtables SNAT out-of-bounds write (CVE-2026-53266). The fourth is the Zyxel GS1900 switch web management overflow (CVE-2026-7273), listed on 21 September.
|
package/data/_indexes/_meta.json
CHANGED
|
@@ -1,22 +1,22 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schema_version": "1.1.0",
|
|
3
|
-
"generated_at": "2026-09-
|
|
3
|
+
"generated_at": "2026-09-23T17:29:47.942Z",
|
|
4
4
|
"generator": "scripts/build-indexes.js",
|
|
5
5
|
"source_count": 64,
|
|
6
6
|
"source_hashes": {
|
|
7
|
-
"manifest.json": "
|
|
7
|
+
"manifest.json": "646e6f6ae33cba54f06830071d72009633c41a440f0609df04e0404dfd58e898",
|
|
8
8
|
"README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
|
|
9
9
|
"data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
|
|
10
10
|
"data/attack-techniques.json": "b77468556136a97de0c081633ece85a135487dbf18fc70c3b5ff04c34fa3956e",
|
|
11
|
-
"data/cve-catalog.json": "
|
|
11
|
+
"data/cve-catalog.json": "1af0638314f9a5e345a072a2e855c76fbf33e4628c44c77d8242d5323c5f8394",
|
|
12
12
|
"data/cwe-catalog.json": "10161a298d27b9e0127198651d2eda7d8514a085d55fa6181106e2c8085f05c4",
|
|
13
13
|
"data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
|
|
14
14
|
"data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
|
|
15
|
-
"data/exploit-availability.json": "
|
|
15
|
+
"data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
|
|
16
16
|
"data/framework-control-gaps.json": "d80e39cfb44c7144f70ab5c695f802274c99af0e550722ea8b0cf66d2d03537b",
|
|
17
17
|
"data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
|
|
18
18
|
"data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
|
|
19
|
-
"data/zeroday-lessons.json": "
|
|
19
|
+
"data/zeroday-lessons.json": "85abc4930e60c6615113679ce1f428b055c68d1d5d3593d53fb8d9ea08e05811",
|
|
20
20
|
"skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
|
|
21
21
|
"skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
|
|
22
22
|
"skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
|