@blamejs/exceptd-skills 0.21.4 → 0.21.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.21.6 — 2026-09-27
+
+The catalog holds 1,757 CVEs after three additions from CISA KEV: CVE-2021-22893, an authentication bypass in Pulse Connect Secure, CVE-2021-20022, an arbitrary file upload in SonicWall Email Security, and CVE-2021-38645, a local privilege escalation in Microsoft's Open Management Infrastructure. None has a public exploit. The Pulse Connect Secure and SonicWall flaws carry CISA's ransomware designation and need a restart before the fix takes effect.
+
+## 0.21.5 — 2026-09-27
+
+The catalog holds 1,754 CVEs after two additions from CISA KEV, both SonicWall flaws that carry CISA's ransomware designation: CVE-2021-20021, an improper privilege management flaw in SonicWall Email Security, and CVE-2021-20016, a SQL injection in the SMA 100 series SSL VPN. Neither has a public exploit, and both need a restart before the fix takes effect.
+
 ## 0.21.4 — 2026-09-26
 
 `exceptd refresh --curate-batch` now refuses a batch whose new catalog entries or zero-day lessons cite the curation input instead of a source, as in "Packet: ...", "Packet fields: ...", "the packet names ...", "the packet's own ..." or "per the packet", and it writes nothing when it does. It checks every submitted entry and lesson, including one marked `_auto_imported`. The catalog gap audit has a matching `pipeline-wording` class: `npm run audit-catalog-gaps -- --class pipeline-wording` lists the 2,159 existing texts with that wording (2,157 lesson texts and 2 catalog fields), and the predeploy budget gate fails if the count grows. Wording about network packets, such as "packet data", "Packet fields are not validated", "the malformed packet: its length" or "the packet socket (AF_PACKET)", and the exploit archive Packet Storm do not match.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T05:23:31.640Z",
+  "generated_at": "2026-09-27T16:35:06.498Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "a5da7f2309224913bc385ce3a5ac3d555f2f1a0c7d1013d053ed8f71bfe74e66",
+    "manifest.json": "bba4a92806445f7adb97598feb6485976857b6258d09ab4edd3ba9ed2601688e",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "c2dcbd311fc5280b32e87e7705f5db5f1a5da7a97ac72bd33defa025b5d2c55a",
-    "data/cve-catalog.json": "387f78d2ba3b5961f9e7276ed06cc394f0df8edc8c32c427ac1fc46ce124b895",
-    "data/cwe-catalog.json": "b833d102be2a2485c7c275edcb8140813343fb289d7d9fd352c12ffb016e1bf2",
+    "data/attack-techniques.json": "1c8e3ee0e5e2c0c81bdc753b77caae46d45fd668d676e0a17febc5e50217993f",
+    "data/cve-catalog.json": "5c568853f271d879d23d756d425155c2e8018c3cfde6ce5e9d3c709cefb2f0b1",
+    "data/cwe-catalog.json": "e278adafce665dfe8475c05f4c6e9051e70a3100b2ce340e671a27547bcc0582",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
-    "data/framework-control-gaps.json": "928fe789dab5f9fafcb2f9e7f82e72e5f0e6b94c9781a460338279fb7ff831ce",
+    "data/framework-control-gaps.json": "f6857c6dae6f6a863d80f05ac0c056be2290d91d5b0371e6be5e66525d9e78f0",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "ac80c712f24408667da61433eff002922f3c056b8fb8d9927442814d9fe1c599",
+    "data/zeroday-lessons.json": "21d9bb3092858a41817cf1b7284c9c6e3bf26aedb7aaaf18011bdbb6ba618ff4",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1739,
+    "chains_cve_entries": 1744,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -6,20 +6,20 @@
   },
   "events": [
     {
-      "date": "2026-09-24",
+      "date": "2026-09-27",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1752
+      "entry_count": 1757
     },
     {
-      "date": "2026-09-24",
+      "date": "2026-09-27",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1752
+      "entry_count": 1757
     },
     {
       "date": "2026-09-22",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-09-24",
+      "last_updated": "2026-09-27",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1752,
+      "entry_count": 1757,
       "sample_keys": [
-        "CVE-2026-93952",
-        "CVE-2021-31207",
-        "CVE-2021-34473",
-        "CVE-2020-1380",
-        "CVE-2021-27085"
+        "CVE-2021-20022",
+        "CVE-2021-22893",
+        "CVE-2021-38645",
+        "CVE-2021-20021",
+        "CVE-2021-20016"
       ]
     },
     "cwe-catalog.json": {
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-09-24",
+      "last_updated": "2026-09-27",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1752,
+      "entry_count": 1757,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 36311254 bytes
-sha256: 366466a666605d85809fe074e7a86c98dce01672b3b6e494aff219df50b168a0
+size: 36405496 bytes
+sha256: 1f21de50a9f778f00e23953a3541bde6f506a7ef702783c5b5a77400fac56985

package/data/attack-techniques.json

@@ -328,6 +328,7 @@
       "CVE-2020-2883",
       "CVE-2020-4428",
       "CVE-2020-8218",
+      "CVE-2021-20022",
       "CVE-2021-20035",
       "CVE-2021-26084",
       "CVE-2021-27102",
@@ -926,6 +927,7 @@
       "CVE-2021-36948",
       "CVE-2021-37973",
       "CVE-2021-38003",
+      "CVE-2021-38645",
       "CVE-2021-38648",
       "CVE-2021-38649",
       "CVE-2021-39793",
@@ -1213,6 +1215,8 @@
       "CVE-2020-5735",
       "CVE-2020-8816",
       "CVE-2020-9377",
+      "CVE-2021-20016",
+      "CVE-2021-20021",
       "CVE-2021-20035",
       "CVE-2021-21975",
       "CVE-2021-25296",
@@ -1999,6 +2003,9 @@
       "CVE-2020-9377",
       "CVE-2021-1497",
       "CVE-2021-1498",
+      "CVE-2021-20016",
+      "CVE-2021-20021",
+      "CVE-2021-20022",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20038",
@@ -2017,6 +2024,7 @@
       "CVE-2021-22502",
       "CVE-2021-22506",
       "CVE-2021-22681",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-22986",
       "CVE-2021-22991",
@@ -3199,6 +3207,7 @@
       "CVE-2019-5591",
       "CVE-2020-4427",
       "CVE-2020-8193",
+      "CVE-2021-20016",
       "CVE-2021-22986",
       "CVE-2023-23397",
       "CVE-2023-43791",
@@ -3895,6 +3904,7 @@
       "CVE-2016-6366",
       "CVE-2018-0147",
       "CVE-2019-11580",
+      "CVE-2021-22893",
       "CVE-2021-35587",
       "CVE-2021-44077",
       "CVE-2022-23134",
@@ -6903,6 +6913,7 @@
     "cve_refs": [
       "CVE-2014-100005",
       "CVE-2018-19410",
+      "CVE-2021-20021",
       "CVE-2021-22205",
       "CVE-2021-35587",
       "CVE-2022-23227",
@@ -11879,6 +11890,7 @@
       "CVE-2021-35394",
       "CVE-2021-35464",
       "CVE-2021-36260",
+      "CVE-2021-38645",
       "CVE-2021-38647",
       "CVE-2021-38648",
       "CVE-2021-38649",
@@ -15517,6 +15529,8 @@
       "CVE-2020-1938",
       "CVE-2020-28949",
       "CVE-2020-36193",
+      "CVE-2021-20022",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-23758",
       "CVE-2021-26084",