@blamejs/exceptd-skills 0.21.15 → 0.21.16

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.21.16 — 2026-09-29
+
+The skill catalog-facts predeploy gate now also compares three more skill table columns with the catalog. The Active Exploitation column is compared with `active_exploitation`. A Patch column is compared with `patch_available`; its header is Patch, or Patch followed by "/" and Mitigation, Remediation or Workaround, each word singular or plural and the header optionally followed by Available or Availability. A Live Patch column is compared with `live_patch_available`; its header is Live Patch written with a space or a hyphen, optionally ending in -able or -es, and optionally followed by Available or Availability. A bare "Livepatch" header is not compared. Other patch and exploitation headers ("Patch Reboot Required?", "Patch Applied?", "Active Exploitation Actor") are not compared. Each cell is compared only in a small set of unambiguous wordings, and any other wording is not compared. An exploitation cell is compared when the whole cell is a state such as "Confirmed", "Suspected", "Unknown", "Theoretical only", "Confirmed mass exploitation" or "Confirmed exploitation 2024"; a plain none wording such as "None", "None observed" or "No exploitation observed in the wild", which agrees with a none or theoretical entry, as a Theoretical cell agrees with a none entry; or a plain denial of confirmation such as "No confirmed exploitation" or "None known", which differs only from a confirmed entry. "Confirmed PoC", "Suspected (supply-chain)" and "No confirmed mass exploitation" are not compared. A patch cell reads as a patch when the whole cell is a vendor patch, update or fix statement such as "Vendor patch", "Vendor fix released", "Vendor patch + config hardening" or "Mitigation + vendor patch", or a Yes followed by one ("Yes, vendor patch"). A bare Yes reads as a patch in a Patch column only; under a Patch / Mitigation, Remediation or Workaround header it is not compared. A Yes with any other text after it ("Yes (workaround)", "Yes, if on 2.x") is not compared. A patch cell reads as no patch when the whole cell is a denial such as "Vendor patch pending", "Vendor update not yet available", "No", "No vendor patch (EoL)" or "Mitigation only; no vendor patch". A Live Patch cell is compared when it opens with a Yes or No that ends the cell or is followed by a comma, semicolon, period, colon, dash or parenthesis ("Yes (kpatch/livepatch)"), and no qualifying word or second answer follows; "No-reboot hotpatch", "Yes (kpatch pending)" and "No (Ubuntu); Yes (RHEL kpatch)" are not compared. These three columns are compared only on a row that names a single CVE, under an identifier header or, in a table with no identifier header, in the first column, and only when no other row in the same section has that CVE as its own row CVE. A section runs from one "#" or "##" heading to the next, so "###" and deeper sub-headings ("### RHEL 9") stay in their parent section. A row's own CVE is the one its first CVE-bearing cell names alone, not counting a row whose CVE cell only points to one ("No vendor CVE; see CVE-..."); a row that names no CVE and leaves blank the cell under the row above's CVE continues that row. An identifier header is CVE or CVEs, optionally preceded by Evidence and followed by ID or Class, alone or as one "/" part of the header ("Class / CVE"), with a parenthetical note ignored ("CVE (if any)"). A header that holds a related, sibling, similar, see also, example, e.g., analog, analogue, PoC, demo, exploit, note, comment, rationale, reason, description or detail word (singular or plural), in its note or in any "/" part ("CVE (example)", "PoC / CVE"), is not an identifier header, and a first column under such a header, or under any other header that names a CVE ("CVE Number", "Paired CVE"), does not name the row. When a later cell of the row cites another CVE ("Chained with CVE-..."), when the row's only CVE is a case cited in such a column, or when the section has that CVE as the row CVE of several rows (one row, one table or one sub-heading per distribution or product line), the row's CVSS, RWEP, KEV, public-exploit and AI cells are compared and its exploitation, patch and live-patch cells are not.
+
 ## 0.21.15 — 2026-09-28
 
 The catalog adds CVE-2026-88772, a DTLS memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. CISA added it to KEV on 2026-09-27 with a 2026-09-30 due date and requires forensic triage; Citrix bulletin CTX697096 reports exploitation in the wild. The fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1.37.279, and the upgrade reboots the appliance. The entry puts the Citrix indicator scan and the CTX694799 evidence collection before any upgrade or reboot. It records an appliance with `-dtls OFF` on every SSL VPN virtual server and no virtual server of type DTLS as mitigated with residual risk for this CVE, and states that the setting does not make it safe to defer the upgrade, because the same builds are also affected by CVE-2026-88771, whose KEV facts the entry gives. It scores RWEP 51. The catalog holds 1,759 CVEs.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-29T06:54:34.881Z",
+  "generated_at": "2026-09-30T10:32:27.761Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "53635b9883d8da988e78ae3ac7609fde37fd9d5b8c2bec438041740f5c5ba472",
+    "manifest.json": "f0287eb67bdf0b76c3ea72327ff5a9e117a191248aebaa7f2c41c3849ab10a14",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "b2acec4cc79b03c77a36b29ece0b8c26304db51ac6ab6a1c26c9b8a3c481dcb9",

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.21.15",
+  "version": "0.21.16",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "iFEJzr9ftWZOGEypM+z9quIsJYEn2qp3U/LDsRTueSn6gzhALUbzmwOS3panA23bXo51lWZw2pF2ohifbb2kCA==",
-      "signed_at": "2026-09-29T06:54:33.344Z",
+      "signed_at": "2026-09-30T10:32:26.531Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -134,7 +134,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "IqOnC+FpiNIxtOOGRrl58AxE37F9yE2eWpk5GVgwOUMJ2JUBuDA2otvj0rL6Ep/4GXHiZT6E0xD8UoscL6aLAw==",
-      "signed_at": "2026-09-29T06:54:33.346Z",
+      "signed_at": "2026-09-30T10:32:26.532Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -217,7 +217,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "+zW0ui2tPBoE69HFEuTHzLJkPJD3KLpDCL1murk1N+ALuWEtx/ApgS7eZVH7BsLxVv/uHmmmfw+Uu5cNhrmQAw==",
-      "signed_at": "2026-09-29T06:54:33.346Z",
+      "signed_at": "2026-09-30T10:32:26.533Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -271,7 +271,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-28",
       "signature": "jvtfxzfMmn9EJa6chjp6JeVuKhMFXU72XtcKJSD1GYqd2eHuJjSAN8YkuGuY4s438Gidx/XoHh2A7lkQsVyqDA==",
-      "signed_at": "2026-09-29T06:54:33.347Z"
+      "signed_at": "2026-09-30T10:32:26.533Z"
     },
     {
       "name": "compliance-theater",
@@ -303,7 +303,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "tLhoIS1rmBatiNdvS72YKionixlkS2G018VktqGhLghxZIGDIhIw2nkWnj4dd1k3wydhk1YS4EylpFIYhpSQBA==",
-      "signed_at": "2026-09-29T06:54:33.348Z"
+      "signed_at": "2026-09-30T10:32:26.534Z"
     },
     {
       "name": "exploit-scoring",
@@ -334,7 +334,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "jcplUUQz11YIa3OxWy64ahD9Hy8cLv1Vjv6j0oh8+K4/Rvpcb9iE3ZaJANuf0bGKFTxtEichSGjc19W8OIeKAA==",
-      "signed_at": "2026-09-29T06:54:33.348Z"
+      "signed_at": "2026-09-30T10:32:26.534Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -376,7 +376,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "NSpytlrXh1+o4sX0EqZ746eAm3+mPfl0hgpgE5YHAMcvosOu1icbZ2aR424GrB5rASr7c/5fo+olZcBA4qx9CQ==",
-      "signed_at": "2026-09-29T06:54:33.349Z",
+      "signed_at": "2026-09-30T10:32:26.535Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -443,7 +443,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "/bIjyOG3vcL6sMPX0agXTVCO2Wd6/6/PBMQfjALT63ojxXMwBDz4HQTO00OSkNgvCLTOvcUM4nN4H+4yl+roCg==",
-      "signed_at": "2026-09-29T06:54:33.349Z",
+      "signed_at": "2026-09-30T10:32:26.535Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -484,7 +484,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-28",
       "signature": "Wu9WnqVUI6D2inIiSi4Q8ruzMeviWPv3p8sKE+5wZujrXSOLo8UZ45eGlr99KiTkRYFa134hoMHVe3cQ1pIuDQ==",
-      "signed_at": "2026-09-29T06:54:33.350Z",
+      "signed_at": "2026-09-30T10:32:26.535Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -519,7 +519,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-28",
       "signature": "0Ihy5ugnEpT8bDGGCzm21W+8gdTzbCXDjj+UmxuvmGaV+hZKax9JcWFYxmkC710Q2HVyTFZ23iXMIsV+9v2vAw==",
-      "signed_at": "2026-09-29T06:54:33.350Z",
+      "signed_at": "2026-09-30T10:32:26.536Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -560,7 +560,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
       "signature": "u/3QUr3Nh0q1tjOaHQ3yC4WIJOUoABr+6R8VStCgS4NvNBglb/JcbLYvQmFixqdURu4Qi6xtqvUw0E14b5mtDA==",
-      "signed_at": "2026-09-29T06:54:33.351Z",
+      "signed_at": "2026-09-30T10:32:26.536Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -602,7 +602,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-28",
       "signature": "qRK6ncDD1o//GLwO/CfVMKK+sppjkuIaql9q5i+GxwMiJxQPPdmTkdvqPmWlV/cnrR90BtrseTBLSbWQB1mGDw==",
-      "signed_at": "2026-09-29T06:54:33.352Z",
+      "signed_at": "2026-09-30T10:32:26.537Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -671,7 +671,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "r8tW6PJ8G0Sjd9nyr6rWJ11dovdH9llEe6eAldHedUKRl+vdbQd4g5Cefs2Q/xcNzoXGh3C0usNLX8jX4EaWBQ==",
-      "signed_at": "2026-09-29T06:54:33.353Z",
+      "signed_at": "2026-09-30T10:32:26.537Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -721,7 +721,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "R9cbLm2pz1MupiQpWk3CtrnlZ06VQQ5gN5MWlMEbF+aFTHdK7JsSXoyLodZYDo1U+ROQ+4OH2VXo0Z+54k/KBw==",
-      "signed_at": "2026-09-29T06:54:33.354Z"
+      "signed_at": "2026-09-30T10:32:26.538Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -761,7 +761,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "PE1cz77xEf4rBJghx2cDug6QdyL2qIqn1hoS5NyhLS/5JC+qENLuNBUK4jUVPl+NDv+1+IPBFcPaL+eSCB2YBA==",
-      "signed_at": "2026-09-29T06:54:33.354Z",
+      "signed_at": "2026-09-30T10:32:26.538Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -815,7 +815,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
       "signature": "Lb71p2XDRGmSUe4LGxiMl5HgJQ6gOVvWhjZ24dz8eBt7q+9qb0dLMMXshsfmreTjRU4ArNv50QPLZFFh9l+HCw==",
-      "signed_at": "2026-09-29T06:54:33.355Z"
+      "signed_at": "2026-09-30T10:32:26.539Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -891,7 +891,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "tBzI4lHl8F2+MeDZIOak1IYUBy8rrbgbc7M5uvodJXBKs+Rj9BmC0quk3NEcNRma8eIawUyyjU5ieFMi5MpiBQ==",
-      "signed_at": "2026-09-29T06:54:33.355Z"
+      "signed_at": "2026-09-30T10:32:26.539Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -952,7 +952,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "1rpQIBRamlNF6gFGwycmgGLcmNalYeAZjkRKdQ0NWQW1lXQegE4sTObgDFkKCLuLSB+6j3zjzinwSQyxwxL9Dw==",
-      "signed_at": "2026-09-29T06:54:33.357Z"
+      "signed_at": "2026-09-30T10:32:26.539Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -1030,7 +1030,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "wKN08ODL/5Z1Kr1ySnDqj/eWY013y13LRqupqEERjMLjKMxuFiC6cLUaPjUyachML0PZAZrWYlCdfrggbNxkDg==",
-      "signed_at": "2026-09-29T06:54:33.357Z"
+      "signed_at": "2026-09-30T10:32:26.540Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1114,7 +1114,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "nAxLtc0jWsb5QuMQBRxAax05YFw4lLHGtl/xoX0mzMjPfvSAXJrSxMtX5CzDYuvTPKUuopwZDfCltKL+pRQoDw==",
-      "signed_at": "2026-09-29T06:54:33.358Z"
+      "signed_at": "2026-09-30T10:32:26.540Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1171,7 +1171,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "W8kg2Okd/VF521VmeVFGK2TmXkFPycuwgYdyNxLU2fMN+sR9Aals/X+Xqr/prrGEsqWnZsCInSq1TYzFr0wiDg==",
-      "signed_at": "2026-09-29T06:54:33.358Z"
+      "signed_at": "2026-09-30T10:32:26.540Z"
     },
     {
       "name": "identity-assurance",
@@ -1245,7 +1245,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-09-29T06:54:33.358Z"
+      "signed_at": "2026-09-30T10:32:26.541Z"
     },
     {
       "name": "ot-ics-security",
@@ -1304,7 +1304,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-09-18",
       "signature": "2pmqMIfqL1VAK5ZzPY4l1wllI7tnl5ne7ML6u9qQnA3SScRR1++TPUjEaB3iLZeRanCKGgkMj8LmU96dbqYYDA==",
-      "signed_at": "2026-09-29T06:54:33.359Z"
+      "signed_at": "2026-09-30T10:32:26.541Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1364,7 +1364,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "FfzagIXtJNegSNPjLSI11fnQqxXJ4nSfPcv+IdbD3XmIfDTxnV7nTAR0tCQKqOGKpsyYEwAZP5jQzA3tIuJJBw==",
-      "signed_at": "2026-09-29T06:54:33.359Z"
+      "signed_at": "2026-09-30T10:32:26.541Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1418,7 +1418,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "0njaUBtRgD+5ys5xh1x+daPI2xhnHzZP+pielUdqEndR2/uDAuf3XIDUWnhC8LKr+33HSX3pXmqfgbXJpyqxBQ==",
-      "signed_at": "2026-09-29T06:54:33.360Z"
+      "signed_at": "2026-09-30T10:32:26.542Z"
     },
     {
       "name": "webapp-security",
@@ -1501,7 +1501,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "YhdXy2fMZubdoGemwvt8XCPFaMpcA3uVzGlGH7j+3koPuPl99VqkD1Q2gsJjs894V3CiRSWuRU75q4nIGwUAAQ==",
-      "signed_at": "2026-09-29T06:54:33.360Z",
+      "signed_at": "2026-09-30T10:32:26.542Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1562,7 +1562,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "+x25rPi9K6Yo39Nj9ZN+PV4y0yQ9z9mNmOrBISYLsWrjqVTACCUFI+mp4w/nV6sZueEMoiar+inwE/fucbuiDw==",
-      "signed_at": "2026-09-29T06:54:33.361Z"
+      "signed_at": "2026-09-30T10:32:26.542Z"
     },
     {
       "name": "sector-healthcare",
@@ -1630,7 +1630,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "XMI/ZJn07vHRmN+zRCbYh+JH0bUaRL0KpthMVfRXGz3ELqQqeLG7eUrrnBWnJ5GhsWTuYY/dGCyDdsVyBKtNDA==",
-      "signed_at": "2026-09-29T06:54:33.361Z"
+      "signed_at": "2026-09-30T10:32:26.543Z"
     },
     {
       "name": "sector-financial",
@@ -1719,7 +1719,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "gFUmQCkAfdW++Mb+UcwHTATJcZuszFA3dQSD+v3asEdYYsSFt63L03p09Y3JWN0c4JS4jAC1x08WsgYSklSCBQ==",
-      "signed_at": "2026-09-29T06:54:33.362Z"
+      "signed_at": "2026-09-30T10:32:26.543Z"
     },
     {
       "name": "sector-federal-government",
@@ -1796,7 +1796,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "Nc6G/hJJmvzFL628xQnpEjOOLvhm3JVv9Xbh0KMiBPChZqKqmY2Eebk67Iz2ywM/bcwTUWEVAL8LQ9lcqGbpDA==",
-      "signed_at": "2026-09-29T06:54:33.362Z"
+      "signed_at": "2026-09-30T10:32:26.543Z"
     },
     {
       "name": "sector-energy",
@@ -1870,7 +1870,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "tpbR4Azrmbh9YSByEBqsb40/c6e17bKw6RDYzdW1P1gK31g+It5wOCgVvoacCv4F5SjQWIQnlrm1QWTMYYJWAA==",
-      "signed_at": "2026-09-29T06:54:33.363Z"
+      "signed_at": "2026-09-30T10:32:26.544Z"
     },
     {
       "name": "sector-telecom",
@@ -1956,7 +1956,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "G7WrqBaR/Nqf4zhYdS69gBsunZJolx0saEAAd6Y+3ev8iN7mDiB5H0W+ow+YZjD74hhsJr4ks3RD/yKulavXCQ==",
-      "signed_at": "2026-09-29T06:54:33.363Z"
+      "signed_at": "2026-09-30T10:32:26.544Z"
     },
     {
       "name": "api-security",
@@ -2035,7 +2035,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "y6LfKfsHtpPT+UBrfkXVR4xO139xvzrWOGTdyeEAna1kecWDJIqKKMdSpHqR4T7KG2HCAmgLCV2cmf3B3jnkAg==",
-      "signed_at": "2026-09-29T06:54:33.364Z",
+      "signed_at": "2026-09-30T10:32:26.545Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2131,7 +2131,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "f7b0+D4TJwd9c9ISGMFquvePueywoO92QZ172etyayBcDwYVTIiGYII67+NyaLl2+u0QG49d4QY41UPbRflrDw==",
-      "signed_at": "2026-09-29T06:54:33.365Z"
+      "signed_at": "2026-09-30T10:32:26.545Z"
     },
     {
       "name": "container-runtime-security",
@@ -2203,7 +2203,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "XT0iHNb0zTgBewACN1jXOfiXzVC3BpD7KoJgi9KcvTWPFE8Y2TzrqMmkftoUbyyCyNSecFB17z9ydoPswMWyDA==",
-      "signed_at": "2026-09-29T06:54:33.366Z",
+      "signed_at": "2026-09-30T10:32:26.546Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2284,7 +2284,7 @@
         "MITRE ATLAS release 2026.06 (June 2026) added AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie) and AML.T0114 (AI Service Web Interface) to release 2026.05 and removed no technique ids. Earlier releases shipped the AML.T0010 sub-technique expansion and the agentic-AI techniques this forecast tracked (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"). Forward watch: subsequent monthly ATLAS releases, for updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "+DWL+I6VipjzZpvjZptUNk7jrCYhOBQqFy1ejThc4Gdr2BJ5vWYuRWclUUd4RhC58iv4S3NAgatuZOcXTOkRCg==",
-      "signed_at": "2026-09-29T06:54:33.366Z"
+      "signed_at": "2026-09-30T10:32:26.546Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2359,7 +2359,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "GXEqUic3Dg65QODe/2+AA5PJ2gkRLf39/AbFaZDt19GzknfhHlBxQf7LrpDX2S87JKPHzHPShRAFRxJSW90LAA==",
-      "signed_at": "2026-09-29T06:54:33.367Z"
+      "signed_at": "2026-09-30T10:32:26.547Z"
     },
     {
       "name": "ransomware-response",
@@ -2439,7 +2439,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "ULB2eBGPwh5vgOTK9m9i7Do25p48npVDpyDqjRYOfUUHoYvXkG+XxF0DdJLrs27ngQ2TyETn6X9xKp4310RGBA==",
-      "signed_at": "2026-09-29T06:54:33.367Z"
+      "signed_at": "2026-09-30T10:32:26.547Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2507,7 +2507,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-09-29T06:54:33.368Z"
+      "signed_at": "2026-09-30T10:32:26.547Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2582,7 +2582,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "rlHzyruu9OhkcVrYfHnMJvQf9z3rnDh5VbDQr4qCmqFXTzPqyQz9u1GvKdNiElSNXv3Qv3afvUFsvcHxOxX4DQ==",
-      "signed_at": "2026-09-29T06:54:33.368Z"
+      "signed_at": "2026-09-30T10:32:26.548Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2662,7 +2662,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "JzYf4O9qu4rJV3FZFDl0u/PgBqhwvrlJt8SM9lAEcJf8ZpGKaCmQ2cYIKZ94zzxH6G1KiUADuHUMCXEYJLAPDA==",
-      "signed_at": "2026-09-29T06:54:33.369Z",
+      "signed_at": "2026-09-30T10:32:26.548Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2756,7 +2756,7 @@
       ],
       "last_threat_review": "2026-09-28",
       "signature": "RqfshMse1fZQ5oeObQypeRFtc0kioh1DdqICbFSX2OiAjku2JJFj90ld7Hhal86o0DtSJ0bSA8uoQquJYbUbCQ==",
-      "signed_at": "2026-09-29T06:54:33.370Z",
+      "signed_at": "2026-09-30T10:32:26.549Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2828,7 +2828,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-09-29T06:54:33.370Z"
+      "signed_at": "2026-09-30T10:32:26.549Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2887,7 +2887,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-09-29T06:54:33.370Z"
+      "signed_at": "2026-09-30T10:32:26.549Z"
     },
     {
       "name": "network-trust",
@@ -2943,7 +2943,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-09-29T06:54:33.371Z"
+      "signed_at": "2026-09-30T10:32:26.549Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2998,7 +2998,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
-      "signed_at": "2026-09-29T06:54:33.371Z"
+      "signed_at": "2026-09-30T10:32:26.550Z"
     },
     {
       "name": "self-update-integrity",
@@ -3052,7 +3052,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "OKVmNgVoGGDS8kwezWrtFk62xgYkU3B7lhGRd7xO7wfSQPbETk+aeLmkpoS8sTryzrAg7JYhJ0qDofbSQpOTCg==",
-      "signed_at": "2026-09-29T06:54:33.371Z"
+      "signed_at": "2026-09-30T10:32:26.550Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3110,7 +3110,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "MWDxwIfhUvGAet5F1LBJnBApTBHafuW+NwysdaSYh8DmPM70bcg6v7f7qwv+zADXYc1LHdF4FoqiAcFy8TA7DA==",
-      "signed_at": "2026-09-29T06:54:33.372Z"
+      "signed_at": "2026-09-30T10:32:26.550Z"
     },
     {
       "name": "decompression-dos",
@@ -3168,7 +3168,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "iDsEYQo/OWYUI8TbBNsS9A60Kt5XEcZ1WYKg52wuSAzgctn4W68dgMeaoNbPXq2Bon1amFKIH5uxUtU8q7I/Dw==",
-      "signed_at": "2026-09-29T06:54:33.372Z"
+      "signed_at": "2026-09-30T10:32:26.550Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3223,7 +3223,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "1Qn1LUzL2qCvG+jEaif7uMVL/cDwyMVueZAhu5uSroQzfw1V5X2vm/t69fExGKoLnVdkfta71aZWI4Gz0tfiDQ==",
-      "signed_at": "2026-09-29T06:54:33.372Z"
+      "signed_at": "2026-09-30T10:32:26.550Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3278,11 +3278,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "UIzZfFwZP/7Gg5IdwQQTv6oDZyzjID8lXWYL1SgiSu4JRPJYzt/vqQO1ztfEaaRdbZBi0Vao3td2aFixnhw6AQ==",
-      "signed_at": "2026-09-29T06:54:33.373Z"
+      "signed_at": "2026-09-30T10:32:26.551Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "RF6c9zrUGSKZFl60JBDPL4dzddePj1hT1X+F5qLdPwaKgfukSNNXUb3++b6bsZk6wzWVspXfFyxxjQfiOaiYAQ=="
+    "signature_base64": "3andaihAjaRAIL4RO5fTRajdZc5vEDrB1bW2etTRb8ECA4heFFIhgmPlLV1Ib1CCFSumoJYZXJnJZXr//YQABQ=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.21.15",
+  "version": "0.21.16",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1759 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:f0d7e722-9418-4c65-abfa-825ae68d170e",
+  "serialNumber": "urn:uuid:d7447d56-ce40-4f85-9d96-520994216720",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-28T00:00:00.000Z",
+    "timestamp": "2026-09-29T00:00:00.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.21.15"
+        "version": "0.21.16"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.21.15",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.21.16",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.21.15",
+      "version": "0.21.16",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1759 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.21.15",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.21.16",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2ecf804c3bf533da1b2cf8b4e3daa604709fdaab17840fc26d1e1c1e70015f14"
+          "content": "8f94c4d5bcc8821d45ded4dcec65c625e93f375d666c813ce0d254e92eabc5c8"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.21.15"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.21.16"
         },
         {
           "type": "vcs",
@@ -124,11 +124,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aaa45a410b82a8d3708df333280de3f7201d3ee1a5387bd5a51b12db105f30d4"
+          "content": "6d59921d08dc1a0658477c5b0017050e37a50eff5ead3a70cde13f74a5a8a244"
         },
         {
           "alg": "SHA3-512",
-          "content": "508d20fec91b4c4c2918dc6c5fa0111418f107e0f066863526d43b18d49c7ec8a3ced9466c725fc1d383b2175ce8b9c4dc02714148436f2734e58d22b2f942cf"
+          "content": "6e1f30b18a7ab313d8a633e0f38644f6e8e00c47e5f372ca292064a50a100f194011f7ac3cad275601694273fdc539d692631ddc5cf412cd2f37bfef45e3b21b"
         }
       ]
     },
@@ -1954,11 +1954,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "53635b9883d8da988e78ae3ac7609fde37fd9d5b8c2bec438041740f5c5ba472"
+          "content": "f0287eb67bdf0b76c3ea72327ff5a9e117a191248aebaa7f2c41c3849ab10a14"
         },
         {
           "alg": "SHA3-512",
-          "content": "1b1392e66ac787173916986fed9774cf3f8f9ad8c4ceb76f4884ae860a69bec10abd9cbf469a5db7a999b4712698830f6b28a15222a4e776a97077ed4f0cad75"
+          "content": "94461fa5cf19fd37a41e5e839616aed28eb7160768e80859b3c77c6e18a61d9efd39bc4e1ccc01c0fcfe4ed44f68c915f760d4c8689b9dad22edb0ce7c258e45"
         }
       ]
     },
@@ -2074,11 +2074,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aeb04f3de193ce0a43956b566e846d21098e24e6de4f7dced4ec21078a8d2fd6"
+          "content": "337787992a8a8d1e495fe8ee51f6d2586e9b6fc02efb17175e3a90ef1ef0aaea"
         },
         {
           "alg": "SHA3-512",
-          "content": "234919ce2ead2e3a1b8382dbc05eaff95d764b05fa255c48c761512e572e81727bbb2a479432919ada841b572994ae9a69dd8eb8efd0e374de39733783716904"
+          "content": "0e377fb752f09c575cb2c48a6d212fe24a987a304ed2f745d479bc68f0fc8fc37d64fa73e831ea0ce6b03109da5f43f4e769a45562623fc8f8e7778bf90a9991"
         }
       ]
     },
@@ -2539,11 +2539,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f068f3ce319f7f302a6f33924ab77140b379b92d1f54ddaab5aa74ed26813164"
+          "content": "2c513a828bb76d0cb25009ff5d45e0663210bfa56bb0319890f5f383ff8d29c7"
         },
         {
           "alg": "SHA3-512",
-          "content": "19da9c54538c46136460bf06260c29e95e824b467112c4d0a7176060e221e66060458db2a2a4b80a08480df7aefc450ce9589ab8691544eb98211dc3f2e13198"
+          "content": "ea328da6fca702a680cb00ce4729d644002190311a80328b5c97b661834822c747882a6d3f3bd73f1fc993d1c2d79befe81f67a5ea3d3c36a224a17fa5841c71"
         }
       ]
     },

package/scripts/check-skill-catalog-facts.js

@@ -10,7 +10,23 @@
  * cell gives one), a public-exploit column (Yes/No), and an AI column. An
  * "AI-Discovered" column is compared with ai_discovered; an AI column that also
  * covers acceleration, enablement or weaponization is compared with
- * ai_discovered OR ai_assisted_weaponization. A prose line that names exactly one
+ * ai_discovered OR ai_assisted_weaponization. The Active Exploitation, Patch and
+ * Live Patch columns (the headers columnKind lists) are compared only when no
+ * cell in the row names another CVE, the row's CVE is under an identifier
+ * header (ID_HEADER_PART, with no ROLE_HEADER word) or, in a table with no
+ * identifier column, in the first column under a header that names no CVE and
+ * no role, and no other row in the same section
+ * (from one "#" or "##" heading outside a fenced code block to the next) has
+ * that CVE as its own row CVE (a row that names no CVE and leaves blank the
+ * cell under the row above's CVE continues that row): Active Exploitation in the
+ * STATE_FORMS,
+ * NONE_FORMS or NOT_CONFIRMED_FORMS wording ("No confirmed exploitation"
+ * differs only from Confirmed, and None agrees with Theoretical); Patch in one
+ * of the PATCH_FORMS wordings, or as a Yes alone or followed by a PATCH_FORMS
+ * patch statement (a bare Yes only in a plain Patch column); Live Patch as a Yes
+ * or No that ends the cell or is followed by a comma, semicolon, period, colon,
+ * dash or parenthesis, with no qualifying word or second answer after it. A
+ * prose line that names exactly one
  * catalog CVE is compared on "RWEP <n>", "CVSS <n.n>", "KEV-listed <date>" and
  * "not KEV-listed". On any line, the parentheses that follow a CVE id are read
  * as that CVE's values, so a list such as "CVE-A (90), CVE-B (Dirty Frag, 38,
@@ -63,12 +79,137 @@ function columnKind(header) {
   if (/\bpoc\b|public exploit/.test(h)) return "poc";
   if (/^ai[- ]discovered$/.test(h)) return "ai_discovered";
   if (/^ai\b/.test(h)) return "ai_any";
+  // The exploitation, patch and live-patch columns are read only under these
+  // headers. Any other header ("Patch Reboot Required?", "Patch Downtime",
+  // "Active Exploitation Actor", "Patch / Live Patch") is not compared.
+  if (/^active exploitation$/.test(h)) return "active";
+  // "Live Patch" or "Live-Patch"; a bare "Livepatch" column names Canonical
+  // Livepatch alone in a per-vendor matrix.
+  if (/^live[- ]patch(?:able|es)?(?:\s+availab(?:le|ility))?$/.test(h)) return "live_patch";
+  if (/^patch(?:es)?(?:\s+availab(?:le|ility))?$/.test(h)) return "patch";
+  if (/^patch(?:es)?\s*\/\s*(?:mitigation|remediation|workaround)s?(?:\s+availab(?:le|ility))?$/.test(h)) return "patch_or_mitigation";
   return null;
 }
 
+/**
+ * The vendor-patch phrase: "Vendor patch", "Vendor updates", "Vendor IDE update".
+ * The one qualifier word is a closed list, so a status word in that slot
+ * ("Vendor declined fix", "Vendor never patches") never forms the phrase.
+ */
+const PHRASE = "vendor(?: (?:ide|saas|firmware|security|product|os|kernel|browser|app|agent|server|client|cloud|library|platform))? (?:patch|update|fix)(?:e?s)?";
+// A word that can qualify or reverse the statement it follows ("Yes (kpatch
+// pending)", "Vendor patch + hardening still pending"). A live-patch cell whose text after
+// its leading Yes or No holds one, and a cell in a qualifiable PATCH_FORMS
+// wording that holds one, is not compared.
+const QUALIFYING = /\b(?:not|no|none|never|n\/a|tbd|tba|eta|pending|planned|expected|unavailable|unreleased|awaiting|awaited|outstanding|delayed|forthcoming|upcoming|coming|unknown|soon|later|next|progress|development|scheduled|future|until|needed|required|necessary|still|yet|q[1-4]|if|unless|except|but|although|however|withdrawn|revoked|reverted|pulled|superseded)\b/i;
+
+/**
+ * The patch cells the gate reads, each matched against the whole cell, with the
+ * value it reads and whether a qualifying word leaves it not compared. Any other
+ * wording is not compared.
+ */
+const PATCH_FORMS = [
+  // "Vendor patch", "Vendor updates available", "Vendor patches shipped 2099-01-01".
+  [new RegExp(`^${PHRASE}(?:\\s+(?:is\\s+|are\\s+)?(?:available|released|shipped|published|issued|applied)(?:\\s+\\d{4}-\\d{2}-\\d{2})?)?\\s*\\.?$`, "i"), true, false], // allow:dynamic-regex — built from the static PHRASE literal
+  // "Vendor patch + config hardening", "Vendor IDE update + manifest signing".
+  // Each "+" item starts and ends on a non-space character and stops at "+", ";",
+  // "," or a parenthesis, so the spaces around a "+" can only match `\s*` and a
+  // failing match backtracks at most linearly.
+  [new RegExp(`^${PHRASE}(?:\\s*\\+\\s*[^+;,()\\s](?:[^+;,()]*[^+;,()\\s])?)+$`, "i"), true, true], // allow:dynamic-regex — static PHRASE
+  // "Mitigation + vendor patch".
+  [new RegExp(`^[a-z][a-z -]{0,40}\\+\\s*${PHRASE}\\s*\\.?$`, "i"), true, true], // allow:dynamic-regex — static PHRASE
+  // "Vendor patch pending", "Vendor fix unavailable", "Vendor update not yet available".
+  [new RegExp(`^${PHRASE}\\s+(?:is\\s+|are\\s+)?(?:unavailable|unreleased|pending|planned|not (?:yet )?(?:available|released|shipped|published|issued))\\s*\\.?$`, "i"), false, false], // allow:dynamic-regex — static PHRASE
+  // "No", "None", "No patch", "No vendor fix available", "No vendor patch (product EoL)".
+  [new RegExp(`^(?:no|none)(?:\\s+(?:${PHRASE}|patch(?:es)?|fix(?:es)?|updates?)(?:\\s+(?:is\\s+|are\\s+)?available)?)?(?:\\s+\\((?:product\\s+)?(?:eol|end[- ]of[- ]life|unsupported)\\))?\\s*\\.?$`, "i"), false, false], // allow:dynamic-regex — static PHRASE
+  // "Mitigation only; no vendor patch", "Workaround only, no vendor fix available".
+  [new RegExp(`^(?:mitigations?|workarounds?|compensating controls?)(?:\\s+only)?\\s*[;,]\\s*no\\s+${PHRASE}(?:\\s+available)?\\s*\\.?$`, "i"), false, false], // allow:dynamic-regex — static PHRASE
+];
+
+/**
+ * The value of the first PATCH_FORMS entry that matches the whole cell, or null
+ * when no entry matches or when that entry is qualifiable and the cell holds a
+ * QUALIFYING word.
+ */
+function patchForm(cell) {
+  for (const [re, value, qualifiable] of PATCH_FORMS) {
+    if (re.test(cell)) return qualifiable && QUALIFYING.test(cell) ? null : value;
+  }
+  return null;
+}
+
+/**
+ * A leading Yes or No that ends the cell or is followed by a comma, semicolon,
+ * period, colon, dash or parenthesis ("Yes (kpatch/livepatch)", "No — kpatch
+ * RHEL-only"), or null when another word or a hyphen follows it ("No-reboot
+ * hotpatch", "No reboot"), when a qualifying word comes after it ("Yes (kpatch
+ * pending)"), or when a later Yes follows it ("No (Ubuntu); Yes (RHEL
+ * kpatch)").
+ */
+function plainAnswer(cell) {
+  const m = /^(yes|no)(?=\s*(?:$|[,;.:(—–]|-\s))/i.exec(cell);
+  if (!m) return null;
+  const rest = cell.slice(m[0].length);
+  if (QUALIFYING.test(rest) || /\byes\b/i.test(rest)) return null;
+  return m[1].toLowerCase() === "yes";
+}
+
+/**
+ * A Patch column cell's claim. A Yes reads as a patch when a PATCH_FORMS patch
+ * statement follows it ("Yes, vendor patch"), or when it is the whole cell in a
+ * plain Patch column; in a "Patch / Mitigation", "Patch / Remediation" or "Patch
+ * / Workaround" column a bare Yes can answer for the mitigation and is not
+ * compared. A Yes with any other text after it ("Yes (workaround)", "Yes, if on
+ * 2.x") is not compared. Any other cell is read only when the whole cell is one
+ * of PATCH_FORMS.
+ */
+function patchCellValue(cell, kind) {
+  if (/^yes\b/i.test(cell)) {
+    // "Yes (vendor IDE update)" is read on the text inside the parentheses.
+    const wrapped = /^yes\s*\(([^()]*)\)\s*\.?$/i.exec(cell);
+    const rest = wrapped ? wrapped[1].trim() : cell.replace(/^yes\b[\s,;:—–-]*/i, "");
+    if (/^\.?$/.test(rest)) return kind === "patch" ? true : null;
+    return patchForm(rest) === true ? true : null;
+  }
+  return patchForm(cell);
+}
+
+/** The cells that read as no exploitation: "None", "None observed", "No exploitation observed in the wild". */
+const NONE_FORMS = /^(?:none|no)(?:\s+(?:in[- ]the[- ]wild\s+)?exploitation)?(?:\s+(?:observed|recorded|reported|seen|detected))?(?:\s+in[- ]the[- ]wild)?\s*\.?$/i;
+/** The cells that deny confirmation: "No confirmed exploitation", "No exploitation confirmed", "None known", "No known in-the-wild use". */
+const NOT_CONFIRMED_FORMS = /^(?:(?:no|none)\s+(?:yet\s+)?(?:publicly\s+)?(?:confirmed|known)(?:\s+(?:in[- ]the[- ]wild\s+)?(?:exploitation|use|attacks?))?(?:\s+in[- ]the[- ]wild)?|no\s+(?:in[- ]the[- ]wild\s+)?exploitation\s+(?:yet\s+)?(?:publicly\s+)?(?:confirmed|known))\s*\.?$/i;
+/** The cells that name a state: "Confirmed", "Confirmed mass exploitation", "Confirmed exploitation 2024", "Theoretical only". */
+const STATE_FORMS = /^(confirmed|suspected|unknown|theoretical)(?:\s+(?:mass\s+|active\s+)?exploitation)?(?:\s+\d{4}(?:\s*[-–]\s*\d{4})?)?(?:\s+only)?\s*\.?$/i;
+
+/**
+ * Active-exploitation cell, read only when the whole cell is one of STATE_FORMS,
+ * NONE_FORMS or NOT_CONFIRMED_FORMS. "No confirmed exploitation" (or "None
+ * known") denies confirmation, not exploitation: it is true of every state but
+ * confirmed, so it returns "not_confirmed", which differs only from a confirmed
+ * entry. Any other wording ("Confirmed PoC", "No confirmed mass exploitation",
+ * "Suspected (supply-chain)", "No data") is not compared.
+ */
+function exploitationValue(cell) {
+  if (NOT_CONFIRMED_FORMS.test(cell)) return "not_confirmed";
+  if (NONE_FORMS.test(cell)) return "none";
+  const m = STATE_FORMS.exec(cell);
+  return m ? m[1].toLowerCase() : null;
+}
+
 /** A cell's text with Markdown emphasis and code marks removed. */
 const plain = (cell) => cell.replace(/[*_`]/g, "").trim();
 
+/** The column kinds compared only on a row that names a single CVE. */
+const ROW_CVE_KINDS = new Set(["active", "patch", "patch_or_mitigation", "live_patch"]);
+/**
+ * One "/" part of an identifier column's header, with parenthetical notes
+ * removed: CVE or CVEs, optionally preceded by Evidence and followed by ID or
+ * Class ("CVE", "CVE ID", "Evidence CVE", "CVE Class", "CVE (if any)").
+ */
+const ID_HEADER_PART = /^(?:evidence\s+)?cves?(?:\s+(?:id|class))?$/i;
+/** A header word that marks a column as describing or citing a case, not naming the row. */
+const ROLE_HEADER = /\b(?:related|siblings?|similar|see[- ]also|examples?|e\.g|analog(?:ue)?s?|pocs?|demos?|exploits?|notes?|comments?|rationales?|reasons?|descriptions?|details?)\b/i;
+
 function compareCell(kind, raw, e, say) {
   const cell = plain(raw);
   if (kind === "cvss") {
@@ -97,6 +238,20 @@ function compareCell(kind, raw, e, say) {
     const v = aiValue(cell, /^ai[- ](?:discovered|assisted|accelerated|enabled|weaponi[sz]ed)\b/i);
     const expected = Boolean(e.ai_discovered) || Boolean(e.ai_assisted_weaponization);
     if (v !== null && v !== expected) say(`AI "${cell.slice(0, 40)}", catalog ai_discovered ${e.ai_discovered} / ai_assisted_weaponization ${e.ai_assisted_weaponization}`);
+  } else if (kind === "active") {
+    const v = exploitationValue(cell);
+    const actual = String(e.active_exploitation || "").toLowerCase();
+    // The catalog's theoretical state is a public PoC with no exploitation seen,
+    // so a None cell agrees with it, and a Theoretical cell with a none entry.
+    const quiet = (s) => s === "none" || s === "theoretical";
+    const differs = v === "not_confirmed" ? actual === "confirmed" : v !== actual && !(quiet(v) && quiet(actual));
+    if (v && actual && differs) say(`active exploitation "${cell.slice(0, 40)}", catalog ${actual}`);
+  } else if (kind === "patch" || kind === "patch_or_mitigation") {
+    const v = patchCellValue(cell, kind);
+    if (v !== null && v !== Boolean(e.patch_available)) say(`patch "${cell.slice(0, 40)}", catalog patch_available ${e.patch_available}`);
+  } else if (kind === "live_patch") {
+    const v = plainAnswer(cell);
+    if (v !== null && v !== Boolean(e.live_patch_available)) say(`live patch "${cell.slice(0, 40)}", catalog live_patch_available ${e.live_patch_available}`);
   }
 }
 
@@ -216,7 +371,34 @@ function compareFactorRow(cells, rawHeader, e, say) {
 function checkSkill(file, catalog) {
   const seen = new Set();
   const failures = [];
-  const push = (msg) => { if (!seen.has(msg)) { seen.add(msg); failures.push(msg); } };
+  // Each failure carries the order in which it was found, so failures held back
+  // until the section ends are still reported in line order.
+  let seq = 0;
+  const push = (msg, at = seq++) => { if (!seen.has(msg)) { seen.add(msg); failures.push([at, msg]); } };
+  // Exploitation, patch and live-patch failures are held until the section ends
+  // (the next "#" or "##" heading, or the end of the file) and kept only for a
+  // CVE that is the row CVE of exactly one row in that section. A per-distribution
+  // or per-version table ("RHEL 9 | Yes", "Ubuntu 24.04 | No"), one table or one
+  // "###" sub-heading per distribution, or a continuation row that leaves the CVE
+  // cell blank answers for one row at a time, not for the CVE.
+  let held = [];
+  let rowCves = new Map();
+  let lastRowCve = null;
+  let lastRowCol = -1;
+  const flush = () => {
+    for (const [at, cve, msg] of held) if (rowCves.get(cve) === 1) push(msg, at);
+    held = [];
+    rowCves = new Map();
+    lastRowCve = null;
+  };
+  // A "#" line inside a fenced code block does not end the section for the
+  // exploitation, patch and live-patch row count. A fence closes only on a line
+  // of its own character, at least as long as the opening run, with nothing
+  // after it. A nested code block that uses the other character or a shorter run
+  // leaves the outer fence open; a bare run of the same character at least as
+  // long as the outer one closes it.
+  let fence = null;
+  const countRow = (cve) => rowCves.set(cve, (rowCves.get(cve) || 0) + 1);
   let compared = 0;
   let header = null;
   let rawHeader = null;
@@ -224,33 +406,68 @@ function checkSkill(file, catalog) {
   const lines = fs.readFileSync(file, "utf8").split(/\r?\n/);
   lines.forEach((line, i) => {
     const where = `${path.relative(ROOT, file).replace(/\\/g, "/")}:${i + 1}`;
+    const fenceLine = /^\s*(`{3,}|~{3,})(.*)$/s.exec(line);
+    if (fenceLine && !fence) fence = fenceLine[1];
+    else if (fenceLine && fenceLine[1][0] === fence[0] && fenceLine[1].length >= fence.length && !fenceLine[2].trim()) fence = null;
     if (/^#{1,6}\s/.test(line)) {
+      // A "###" or deeper heading ("### RHEL 9", "### Ubuntu 24.04") stays in its
+      // parent section for the row count.
+      if (!fence && /^#{1,2}\s/.test(line)) flush();
       const headingIds = uniqueCves(line);
       sectionCve = headingIds.length === 1 && catalog[headingIds[0]] ? headingIds[0] : null;
     }
     compared += compareParentheticals(line, catalog, (id, msg) => push(`${where} ${id}: ${msg}`));
     if (/^\s*\|/.test(line)) {
       const cells = splitRow(line);
-      if (header === null) { rawHeader = cells; header = cells.map(columnKind); return; }
+      if (header === null) { rawHeader = cells; header = cells.map(columnKind); lastRowCve = null; return; }
       if (isDivider(cells)) return;
+      // A row that names no CVE and leaves blank the cell under the row above's
+      // CVE continues that row.
+      const continues = lastRowCve && !plain(cells[lastRowCol] || "") && uniqueCves(line).length === 0;
       if (sectionCve && uniqueCves(line).length === 0) {
+        if (continues) countRow(lastRowCve);
+        else lastRowCve = null;
         if (compareFactorRow(cells, rawHeader, catalog[sectionCve], (msg) => push(`${where} ${sectionCve}: ${msg}`))) compared++;
         return;
       }
-      const idCell = cells.find((c) => uniqueCves(c).length > 0) || "";
-      if (/^(?:no|n\/a)\b/i.test(idCell) || /\bsee\s+CVE-/i.test(idCell)) return;
+      const idCol = cells.findIndex((c) => uniqueCves(c).length > 0);
+      const idCell = cells[idCol] || "";
+      if (/^(?:no|n\/a)\b/i.test(idCell) || /\bsee\s+CVE-/i.test(idCell)) { lastRowCve = null; return; }
       const ids = uniqueCves(idCell);
       if (ids.length > 1) {
+        lastRowCve = null;
         const known = ids.filter((id) => catalog[id]);
         const scored = header.some((kind, k) => (kind === "cvss" || kind === "rwep") && /^\d/.test(plain(cells[k] || "")));
         if (known.length && scored) push(`${where} ${ids.join(", ")}: ${UNATTRIBUTED}`);
         return;
       }
-      if (ids.length !== 1 || !catalog[ids[0]]) return;
+      if (continues) { countRow(lastRowCve); return; }
+      if (ids.length !== 1 || !catalog[ids[0]]) { lastRowCve = null; return; }
       const e = catalog[ids[0]];
       compared++;
+      countRow(ids[0]);
+      lastRowCve = ids[0];
+      lastRowCol = idCol;
+      // The exploitation, patch and live-patch cells are read against the row's
+      // CVE only when no cell names another CVE and the CVE sits under an
+      // identifier header (ID_HEADER_PART), or, in a table with no identifier
+      // column, in the first column under a header that names no CVE and no role
+      // (ROLE_HEADER). A row whose CVE is a related
+      // case, cited in a PoC, notes, "Related CVE", "CVE (example)" or similar
+      // column, does not have them compared with that entry.
+      const single = cells.every((c) => uniqueCves(c).every((id) => id === ids[0]));
+      const norm = (h) => (h || "").replace(/[?*`_]/g, " ");
+      const idHeader = (h) => !ROLE_HEADER.test(h) && h.replace(/\([^)]*\)/g, " ").split("/").some((part) => ID_HEADER_PART.test(part.trim()));
+      const first = norm(rawHeader[0]);
+      const idColumn = rawHeader.some((h) => idHeader(norm(h)));
+      const named = idHeader(norm(rawHeader[idCol])) || (idCol === 0 && !idColumn && !/\bcves?\b/i.test(first) && !ROLE_HEADER.test(first));
       header.forEach((kind, k) => {
-        if (kind && cells[k] !== undefined) compareCell(kind, cells[k], e, (msg) => push(`${where} ${ids[0]}: ${msg}`));
+        if (!kind || cells[k] === undefined) return;
+        if (!ROW_CVE_KINDS.has(kind)) {
+          compareCell(kind, cells[k], e, (msg) => push(`${where} ${ids[0]}: ${msg}`));
+        } else if (single && named) {
+          compareCell(kind, cells[k], e, (msg) => held.push([seq++, ids[0], `${where} ${ids[0]}: ${msg}`]));
+        }
       });
       return;
     }
@@ -266,7 +483,8 @@ function checkSkill(file, catalog) {
     compared++;
     compareProse(line, catalog[ids[0]], (msg) => push(`${where} ${ids[0]}: ${msg}`));
   });
-  return { failures, compared };
+  flush();
+  return { failures: failures.sort((a, b) => a[0] - b[0]).map(([, msg]) => msg), compared };
 }
 
 function check(skillsDir, catalog) {