@blamejs/exceptd-skills 0.21.1 → 0.21.3

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.21.3 — 2026-09-24
+
+The catalog holds 1,752 CVEs after 32 additions from CISA KEV. Twenty-one are Microsoft flaws, among them two links of the ProxyShell Exchange chain (CVE-2021-31207 and CVE-2021-34473), the CryptoAPI certificate-validation spoofing flaw CVE-2020-0601, the SharePoint deserialization flaw CVE-2019-0604, and Win32k, Common Log File System and Windows Error Reporting privilege escalations. Five are Oracle WebLogic Server and Oracle Coherence flaws, two are Firefox and Thunderbird use-after-free flaws, and the rest cover Arista VeloCloud Orchestrator, Nagios XI, PlaySMS and Progress Telerik UI for ASP.NET AJAX.
+
+Seventeen of the new entries have a public exploit, four carry CISA's ransomware designation, and 16 need a host restart before the fix takes effect.
+
+Eighteen entries now include their CVE id in the title, because CISA names these flaws by product and defect class and the same name already covered another record. Fifteen are new entries, and three are existing ones: CVE-2017-11826, CVE-2020-14644 and CVE-2022-41082.
+
+`exceptd refresh --curate-batch` now writes a per-CVE test that accepts an empty `cwe_refs` list, which the catalog already allows for records NVD assigns no CWE. The test fails on any value that is not a `CWE-<number>` id. The command also sets `_meta.last_updated` in `data/cve-catalog.json` and `data/zeroday-lessons.json` to the date it applies a batch, and it writes a curator-supplied advisory in the `{ vendor, id, url, published }` form with the `advisory_id`, `severity` and `published_date` fields every other advisory uses.
+
+## 0.21.2 — 2026-09-23
+
+`ai_discovery_source` now records who found each vulnerability, and every catalog entry and its zero-day lesson carry the same value. The affected product's own vendor or project team is `vendor_research`. An outside researcher, security company, incident responder or bug-bounty reporter, named or anonymous, is `human_researcher`, or `bug_bounty_ai_augmented` when AI tooling found the flaw. `unknown` means no source identifies who found or reported the flaw.
+
+389 entries changed, each decided from its own discovery notes:
+
+- 255 that credit an outside researcher or company with finding the flaw, or with reporting it or its exploitation in the wild to the vendor, moved from `vendor_research` to `human_researcher`. CVE-2020-15415, which credits the CLP-team researcher group, is one of them.
+- 87 that name no finder moved from `vendor_research` to `unknown`.
+- The 20 entries that had no value now have one.
+- Five AI-found entries credited to an outside company's AI system moved to `bug_bounty_ai_augmented`: Horizon3, GreyNoise, CERT Polska, and Google's Big Sleep on SQLite and on FFmpeg.
+- Four entries with `ai_discovered` false that carried an AI-only value now read `human_researcher`.
+- 18 others were corrected from their notes, among them six whose notes credit an anonymous outside reporter, which moved from `unknown` to `human_researcher`.
+
+668 lessons were updated to match their catalog entry, and the eight exploit-availability records whose value differed now match their catalog entry. Discovery notes that stated a value the entry does not hold were corrected.
+
+Batch curation now records `unknown` when a judgment names no finder, instead of `vendor_research`, and fills a lesson's value from its entry. The catalog validator reports an AI-only value on an entry whose `ai_discovered` is not true, `human_researcher` on an AI-discovered entry, and a lesson whose value differs from its catalog entry. Under `--strict`, which the pre-publish gate uses, each is an error.
+
 ## 0.21.1 — 2026-09-23
 
 The catalog holds 1,720 CVEs after four additions from CISA KEV. Three are Linux kernel flaws CISA listed on 18 September 2026: the AF_ALG crypto interface race (CVE-2025-39964), the kernel TLS receive-path flaw (CVE-2025-39682) and the ebtables SNAT out-of-bounds write (CVE-2026-53266). The fourth is the Zyxel GS1900 switch web management overflow (CVE-2026-7273), listed on 21 September.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-23T15:55:32.332Z",
+  "generated_at": "2026-09-24T17:32:31.224Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "ac62cce28a6cf5ac86b068772c49be774ab1b3fb71eb8f7f2c840279257cf996",
+    "manifest.json": "b57d31f96b49ed1cc418972797df9c088d418bde0f45ec9a77a2b3ac4c42f9eb",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "b77468556136a97de0c081633ece85a135487dbf18fc70c3b5ff04c34fa3956e",
-    "data/cve-catalog.json": "b4d65c53a1952641b2fc2be0d3fd830ad11a2866c7d8766ad4dde33909bf12e3",
-    "data/cwe-catalog.json": "10161a298d27b9e0127198651d2eda7d8514a085d55fa6181106e2c8085f05c4",
+    "data/attack-techniques.json": "c2dcbd311fc5280b32e87e7705f5db5f1a5da7a97ac72bd33defa025b5d2c55a",
+    "data/cve-catalog.json": "387f78d2ba3b5961f9e7276ed06cc394f0df8edc8c32c427ac1fc46ce124b895",
+    "data/cwe-catalog.json": "b833d102be2a2485c7c275edcb8140813343fb289d7d9fd352c12ffb016e1bf2",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
-    "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "d80e39cfb44c7144f70ab5c695f802274c99af0e550722ea8b0cf66d2d03537b",
+    "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
+    "data/framework-control-gaps.json": "928fe789dab5f9fafcb2f9e7f82e72e5f0e6b94c9781a460338279fb7ff831ce",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "829cb48af805b1ed20867756c14a40a399e506c9fed5c413c2cb74ecb52d24c5",
+    "data/zeroday-lessons.json": "ac80c712f24408667da61433eff002922f3c056b8fb8d9927442814d9fe1c599",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1707,
+    "chains_cve_entries": 1739,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -5,6 +5,22 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-09-24",
+      "type": "catalog_update",
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
+      "schema_version": "1.0.0",
+      "entry_count": 1752
+    },
+    {
+      "date": "2026-09-24",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 1752
+    },
     {
       "date": "2026-09-22",
       "type": "catalog_update",
@@ -252,14 +268,6 @@
       "path": "skills/researcher/skill.md",
       "note": "Triage entry-point for raw threat intel — researches an input across all exceptd data catalogs, RWEP-scores it, and routes the operator to the right specialized skill(s)"
     },
-    {
-      "date": "2026-08-22",
-      "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 1720
-    },
     {
       "date": "2026-08-19",
       "type": "catalog_update",
@@ -276,14 +284,6 @@
       "schema_version": "1.0.0",
       "entry_count": 241
     },
-    {
-      "date": "2026-08-19",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 1720
-    },
     {
       "date": "2026-08-05",
       "type": "skill_review",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-08-22",
+      "last_updated": "2026-09-24",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1720,
+      "entry_count": 1752,
       "sample_keys": [
-        "CVE-2026-53266",
-        "CVE-2025-39964",
-        "CVE-2026-7273",
-        "CVE-2025-39682",
-        "CVE-2026-19490"
+        "CVE-2026-93952",
+        "CVE-2021-31207",
+        "CVE-2021-34473",
+        "CVE-2020-1380",
+        "CVE-2021-27085"
       ]
     },
     "cwe-catalog.json": {
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-08-19",
+      "last_updated": "2026-09-24",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1720,
+      "entry_count": 1752,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 35725516 bytes
-sha256: 47f44e5212c7e924cf55dc4fedf6996a0051fae181c20d1f4c8405ea908320b0
+size: 36311254 bytes
+sha256: 366466a666605d85809fe074e7a86c98dce01672b3b6e494aff219df50b168a0

package/data/attack-techniques.json

@@ -233,6 +233,7 @@
       "CVE-2019-0841",
       "CVE-2019-0880",
       "CVE-2019-1129",
+      "CVE-2021-28310",
       "CVE-2021-28664",
       "CVE-2021-31955",
       "CVE-2024-35250",
@@ -258,6 +259,7 @@
       "CVE-2014-3931",
       "CVE-2014-6278",
       "CVE-2014-8361",
+      "CVE-2015-4852",
       "CVE-2015-7450",
       "CVE-2016-0189",
       "CVE-2016-0752",
@@ -315,6 +317,9 @@
       "CVE-2020-13927",
       "CVE-2020-13965",
       "CVE-2020-14644",
+      "CVE-2020-14750",
+      "CVE-2020-14882",
+      "CVE-2020-14883",
       "CVE-2020-15069",
       "CVE-2020-15415",
       "CVE-2020-17530",
@@ -612,9 +617,12 @@
     "cve_refs": [
       "CVE-2016-0099",
       "CVE-2016-3393",
+      "CVE-2017-11774",
       "CVE-2018-20753",
       "CVE-2019-0752",
       "CVE-2019-1003030",
+      "CVE-2021-31207",
+      "CVE-2021-34473",
       "CVE-2022-30190",
       "CVE-2022-35405",
       "CVE-2022-41040",
@@ -688,9 +696,12 @@
       "CVE-2018-19953",
       "CVE-2018-6882",
       "CVE-2018-8298",
+      "CVE-2018-8653",
       "CVE-2019-0193",
       "CVE-2019-10758",
+      "CVE-2019-1429",
       "CVE-2019-7609",
+      "CVE-2020-1380",
       "CVE-2020-35730",
       "CVE-2021-26829",
       "CVE-2021-30551",
@@ -825,13 +836,16 @@
       "CVE-2019-0211",
       "CVE-2019-0543",
       "CVE-2019-0703",
+      "CVE-2019-0797",
       "CVE-2019-0841",
+      "CVE-2019-0863",
       "CVE-2019-0880",
       "CVE-2019-1064",
       "CVE-2019-1069",
       "CVE-2019-1129",
       "CVE-2019-1130",
       "CVE-2019-1132",
+      "CVE-2019-1214",
       "CVE-2019-1253",
       "CVE-2019-1315",
       "CVE-2019-1322",
@@ -853,8 +867,10 @@
       "CVE-2020-0638",
       "CVE-2020-0683",
       "CVE-2020-0787",
+      "CVE-2020-0986",
       "CVE-2020-1027",
       "CVE-2020-11261",
+      "CVE-2020-1380",
       "CVE-2020-16010",
       "CVE-2020-16017",
       "CVE-2020-17087",
@@ -885,6 +901,7 @@
       "CVE-2021-25395",
       "CVE-2021-25487",
       "CVE-2021-27562",
+      "CVE-2021-28310",
       "CVE-2021-28663",
       "CVE-2021-28664",
       "CVE-2021-29256",
@@ -896,6 +913,8 @@
       "CVE-2021-30952",
       "CVE-2021-30983",
       "CVE-2021-31010",
+      "CVE-2021-31199",
+      "CVE-2021-31201",
       "CVE-2021-3156",
       "CVE-2021-31955",
       "CVE-2021-33739",
@@ -904,8 +923,11 @@
       "CVE-2021-3493",
       "CVE-2021-3560",
       "CVE-2021-36934",
+      "CVE-2021-36948",
       "CVE-2021-37973",
       "CVE-2021-38003",
+      "CVE-2021-38648",
+      "CVE-2021-38649",
       "CVE-2021-39793",
       "CVE-2021-4034",
       "CVE-2021-40449",
@@ -1149,6 +1171,7 @@
       "CVE-2016-11021",
       "CVE-2016-6367",
       "CVE-2016-7836",
+      "CVE-2017-11774",
       "CVE-2017-5521",
       "CVE-2017-6077",
       "CVE-2017-6737",
@@ -1746,6 +1769,7 @@
       "CVE-2015-2051",
       "CVE-2015-3035",
       "CVE-2015-4068",
+      "CVE-2015-4852",
       "CVE-2015-5317",
       "CVE-2015-7450",
       "CVE-2015-7755",
@@ -1859,6 +1883,7 @@
       "CVE-2018-9276",
       "CVE-2019-0193",
       "CVE-2019-0344",
+      "CVE-2019-0604",
       "CVE-2019-1003029",
       "CVE-2019-10068",
       "CVE-2019-10149",
@@ -1874,6 +1899,7 @@
       "CVE-2019-15107",
       "CVE-2019-15271",
       "CVE-2019-1579",
+      "CVE-2019-15949",
       "CVE-2019-16057",
       "CVE-2019-16278",
       "CVE-2019-1652",
@@ -1882,6 +1908,7 @@
       "CVE-2019-16928",
       "CVE-2019-17558",
       "CVE-2019-17621",
+      "CVE-2019-18935",
       "CVE-2019-19006",
       "CVE-2019-19781",
       "CVE-2019-20500",
@@ -1916,7 +1943,10 @@
       "CVE-2020-13927",
       "CVE-2020-13965",
       "CVE-2020-14644",
+      "CVE-2020-14750",
       "CVE-2020-14864",
+      "CVE-2020-14882",
+      "CVE-2020-14883",
       "CVE-2020-15069",
       "CVE-2020-15415",
       "CVE-2020-15505",
@@ -1935,6 +1965,7 @@
       "CVE-2020-25223",
       "CVE-2020-25506",
       "CVE-2020-2551",
+      "CVE-2020-2555",
       "CVE-2020-2883",
       "CVE-2020-28949",
       "CVE-2020-29557",
@@ -1961,6 +1992,7 @@
       "CVE-2020-8196",
       "CVE-2020-8218",
       "CVE-2020-8515",
+      "CVE-2020-8644",
       "CVE-2020-8655",
       "CVE-2020-8816",
       "CVE-2020-9054",
@@ -2010,12 +2042,14 @@
       "CVE-2021-30116",
       "CVE-2021-31166",
       "CVE-2021-31196",
+      "CVE-2021-31207",
       "CVE-2021-3129",
       "CVE-2021-32030",
       "CVE-2021-32648",
       "CVE-2021-33044",
       "CVE-2021-33045",
       "CVE-2021-33766",
+      "CVE-2021-34473",
       "CVE-2021-35247",
       "CVE-2021-35394",
       "CVE-2021-35464",
@@ -2612,6 +2646,7 @@
       "CVE-2026-86218",
       "CVE-2026-9082",
       "CVE-2026-9198",
+      "CVE-2026-93952",
       "CVE-2026-9586",
       "MAL-2025-AI-FOUND-FFMPEG-BIGSLEEP"
     ],
@@ -2933,6 +2968,8 @@
       "CVE-2018-8174",
       "CVE-2018-8298",
       "CVE-2018-8373",
+      "CVE-2018-8653",
+      "CVE-2019-0541",
       "CVE-2019-0752",
       "CVE-2019-0880",
       "CVE-2019-0903",
@@ -2941,6 +2978,7 @@
       "CVE-2019-11708",
       "CVE-2019-1297",
       "CVE-2019-13720",
+      "CVE-2019-1429",
       "CVE-2019-1458",
       "CVE-2019-18426",
       "CVE-2019-2215",
@@ -2951,6 +2989,7 @@
       "CVE-2019-8720",
       "CVE-2020-0878",
       "CVE-2020-1027",
+      "CVE-2020-1380",
       "CVE-2020-15999",
       "CVE-2020-16009",
       "CVE-2020-16010",
@@ -2960,6 +2999,8 @@
       "CVE-2020-27950",
       "CVE-2020-6418",
       "CVE-2020-6572",
+      "CVE-2020-6819",
+      "CVE-2020-6820",
       "CVE-2020-9715",
       "CVE-2020-9818",
       "CVE-2020-9819",
@@ -2978,6 +3019,8 @@
       "CVE-2021-21220",
       "CVE-2021-21224",
       "CVE-2021-22204",
+      "CVE-2021-27059",
+      "CVE-2021-27085",
       "CVE-2021-28550",
       "CVE-2021-28663",
       "CVE-2021-30551",
@@ -3555,6 +3598,7 @@
       "Privilege Escalation"
     ],
     "cve_refs": [
+      "CVE-2019-15949",
       "CVE-2020-8655",
       "CVE-2020-8816",
       "CVE-2021-3156"
@@ -3881,6 +3925,7 @@
     "cve_refs": [
       "CVE-2011-0411",
       "CVE-2019-5591",
+      "CVE-2020-0601",
       "CVE-2021-33515",
       "CVE-2021-38371",
       "CVE-2022-22536",
@@ -4006,8 +4051,10 @@
       "CVE-2018-8174",
       "CVE-2018-8373",
       "CVE-2018-8414",
+      "CVE-2019-0541",
       "CVE-2019-0903",
       "CVE-2019-1297",
+      "CVE-2019-1429",
       "CVE-2020-9819",
       "CVE-2021-21017",
       "CVE-2021-28550",
@@ -4051,6 +4098,7 @@
       "CVE-2014-1776",
       "CVE-2015-3113",
       "CVE-2016-0185",
+      "CVE-2018-8653",
       "CVE-2020-0878",
       "CVE-2020-3580",
       "CVE-2021-1871",
@@ -4874,10 +4922,12 @@
       "CVE-2018-8174",
       "CVE-2018-8298",
       "CVE-2018-8373",
+      "CVE-2018-8653",
       "CVE-2019-0676",
       "CVE-2019-0752",
       "CVE-2019-11634",
       "CVE-2019-13720",
+      "CVE-2019-1429",
       "CVE-2019-1458",
       "CVE-2019-2215",
       "CVE-2019-5786",
@@ -4886,6 +4936,7 @@
       "CVE-2019-8720",
       "CVE-2020-0878",
       "CVE-2020-1027",
+      "CVE-2020-1380",
       "CVE-2020-15999",
       "CVE-2020-16009",
       "CVE-2020-16010",
@@ -4895,6 +4946,8 @@
       "CVE-2020-27930",
       "CVE-2020-6418",
       "CVE-2020-6572",
+      "CVE-2020-6819",
+      "CVE-2020-6820",
       "CVE-2021-0920",
       "CVE-2021-1782",
       "CVE-2021-1789",
@@ -4907,6 +4960,7 @@
       "CVE-2021-21206",
       "CVE-2021-21220",
       "CVE-2021-21224",
+      "CVE-2021-27085",
       "CVE-2021-30533",
       "CVE-2021-30551",
       "CVE-2021-30554",
@@ -6402,6 +6456,9 @@
       "CVE-2017-9805",
       "CVE-2018-11776",
       "CVE-2019-17558",
+      "CVE-2019-18935",
+      "CVE-2020-14750",
+      "CVE-2020-14882",
       "CVE-2020-25506",
       "CVE-2021-23758",
       "CVE-2021-30860",
@@ -7182,6 +7239,7 @@
     "is_subtechnique": false,
     "cve_refs": [
       "CVE-2008-4250",
+      "CVE-2015-4852",
       "CVE-2016-3427",
       "CVE-2016-8735",
       "CVE-2017-0144",
@@ -7210,12 +7268,14 @@
       "CVE-2019-0703",
       "CVE-2019-1068",
       "CVE-2020-0796",
+      "CVE-2020-2555",
       "CVE-2020-3118",
       "CVE-2021-20028",
       "CVE-2021-27137",
       "CVE-2021-27877",
       "CVE-2021-27878",
       "CVE-2021-31166",
+      "CVE-2021-34473",
       "CVE-2021-44228",
       "CVE-2022-20699",
       "CVE-2022-26501",
@@ -7961,6 +8021,7 @@
     "stix_id": "attack-pattern--acd0ba37-7ba9-4cc5-ac61-796586cd856d",
     "is_subtechnique": false,
     "cve_refs": [
+      "CVE-2020-0986",
       "CVE-2020-1027",
       "CVE-2020-3433"
     ]
@@ -9500,6 +9561,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2019-0604",
       "CVE-2022-41125"
     ]
   },
@@ -10650,6 +10712,7 @@
     "cve_refs": [
       "CVE-2009-3129",
       "CVE-2019-15752",
+      "CVE-2019-18935",
       "CVE-2021-31955"
     ]
   },
@@ -11228,7 +11291,10 @@
     "stix_id": "attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2019-18935"
+    ]
   },
   "T1055.002": {
     "id": "T1055.002",
@@ -11692,6 +11758,7 @@
       "CVE-2018-2628",
       "CVE-2018-8414",
       "CVE-2019-10068",
+      "CVE-2020-2555",
       "CVE-2021-22941",
       "CVE-2021-23758",
       "CVE-2021-27852",
@@ -11775,6 +11842,7 @@
       "CVE-2019-12991",
       "CVE-2019-13272",
       "CVE-2019-15107",
+      "CVE-2019-15949",
       "CVE-2019-16057",
       "CVE-2019-1652",
       "CVE-2019-16920",
@@ -11788,10 +11856,12 @@
       "CVE-2020-2509",
       "CVE-2020-25223",
       "CVE-2020-25506",
+      "CVE-2020-2555",
       "CVE-2020-5722",
       "CVE-2020-5902",
       "CVE-2020-7247",
       "CVE-2020-8515",
+      "CVE-2020-8644",
       "CVE-2020-8655",
       "CVE-2020-8816",
       "CVE-2020-9054",
@@ -11810,6 +11880,8 @@
       "CVE-2021-35464",
       "CVE-2021-36260",
       "CVE-2021-38647",
+      "CVE-2021-38648",
+      "CVE-2021-38649",
       "CVE-2021-41379",
       "CVE-2021-42013",
       "CVE-2021-45382",
@@ -12162,6 +12234,7 @@
     "_auto_imported": true,
     "_intake_method": "mitre-attack-stix",
     "cve_refs": [
+      "CVE-2019-18935",
       "CVE-2026-76460"
     ]
   },
@@ -12366,6 +12439,7 @@
       "CVE-2021-44077",
       "CVE-2022-23176",
       "CVE-2025-25249",
+      "CVE-2026-93952",
       "MAL-2026-MOIKA-DEPCONFUSION"
     ]
   },
@@ -13157,6 +13231,7 @@
     "cve_refs": [
       "CVE-2018-8581",
       "CVE-2019-9670",
+      "CVE-2021-31207",
       "CVE-2021-33766",
       "CVE-2022-24682"
     ]
@@ -13599,7 +13674,10 @@
     "stix_id": "attack-pattern--bf147104-abf9-4221-95d1-e81585859441",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2017-11774"
+    ]
   },
   "T1137.005": {
     "id": "T1137.005",
@@ -13788,6 +13866,7 @@
       "CVE-2021-1782",
       "CVE-2021-1789",
       "CVE-2021-21166",
+      "CVE-2021-27085",
       "CVE-2021-30533",
       "CVE-2021-30666",
       "CVE-2021-30762",
@@ -13895,6 +13974,7 @@
       "CVE-2018-8120",
       "CVE-2018-8174",
       "CVE-2018-8414",
+      "CVE-2019-0541",
       "CVE-2019-1297",
       "CVE-2019-8605",
       "CVE-2020-0041",
@@ -13904,6 +13984,7 @@
       "CVE-2020-9907",
       "CVE-2021-21017",
       "CVE-2021-22204",
+      "CVE-2021-27059",
       "CVE-2021-28550",
       "CVE-2021-30657",
       "CVE-2021-30983",
@@ -15422,6 +15503,7 @@
       "CVE-2018-7600",
       "CVE-2018-7602",
       "CVE-2018-7841",
+      "CVE-2019-0604",
       "CVE-2019-10068",
       "CVE-2019-11580",
       "CVE-2019-19781",
@@ -15445,6 +15527,8 @@
       "CVE-2021-27104",
       "CVE-2021-27860",
       "CVE-2021-31196",
+      "CVE-2021-31207",
+      "CVE-2021-34473",
       "CVE-2021-38163",
       "CVE-2021-40870",
       "CVE-2021-42321",
@@ -15522,7 +15606,8 @@
       "CVE-2026-72530",
       "CVE-2026-73570",
       "CVE-2026-75650",
-      "CVE-2026-8452"
+      "CVE-2026-8452",
+      "CVE-2026-93952"
     ]
   },
   "T1505.004": {
@@ -15850,7 +15935,10 @@
     "stix_id": "attack-pattern--dfefe2ed-4389-4318-8762-f0272b350a1b",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-attack-stix"
+    "_intake_method": "mitre-attack-stix",
+    "cve_refs": [
+      "CVE-2026-93952"
+    ]
   },
   "T1543.003": {
     "id": "T1543.003",
@@ -17201,6 +17289,7 @@
     "cve_refs": [
       "CVE-2012-0151",
       "CVE-2013-3900",
+      "CVE-2020-0601",
       "CVE-2026-8398"
     ]
   },