@blamejs/exceptd-skills 0.21.5 → 0.21.7

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.21.7 — 2026-09-27
+
+The catalog holds 1,758 CVEs after one addition from CISA KEV: CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU driver on Android and other Snapdragon devices. It has no public exploit, and the fix needs a device restart. Google's Threat Analysis Group attributes its use as a zero-day to the commercial surveillance vendor Intellexa.
+
+Four Qualcomm entries now include their CVE id in the title, because CISA gives them the same name: the new CVE-2021-1905 and the existing CVE-2022-22071, CVE-2023-33063 and CVE-2025-27038.
+
+The framework gap for Australian ISM control ISM-0298 now also covers the check that an applied update carries the fix for a given vulnerability, such as an Android device whose security patch level is not one the vendor's bulletin lists the fix under. Its theater test asks for that evidence for one remediated CVE, and CVE-2021-1905 is the gap's first evidence entry.
+
+## 0.21.6 — 2026-09-27
+
+The catalog holds 1,757 CVEs after three additions from CISA KEV: CVE-2021-22893, an authentication bypass in Pulse Connect Secure, CVE-2021-20022, an arbitrary file upload in SonicWall Email Security, and CVE-2021-38645, a local privilege escalation in Microsoft's Open Management Infrastructure. None has a public exploit. The Pulse Connect Secure and SonicWall flaws carry CISA's ransomware designation and need a restart before the fix takes effect.
+
 ## 0.21.5 — 2026-09-27
 
 The catalog holds 1,754 CVEs after two additions from CISA KEV, both SonicWall flaws that carry CISA's ransomware designation: CVE-2021-20021, an improper privilege management flaw in SonicWall Email Security, and CVE-2021-20016, a SQL injection in the SMA 100 series SSL VPN. Neither has a public exploit, and both need a restart before the fix takes effect.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T14:51:02.622Z",
+  "generated_at": "2026-09-27T17:35:13.161Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "02398f4bcc28238623b56128e7e517d6b33375360be62c7cf799b3896d1b5a93",
+    "manifest.json": "1a53c846b758ff96c4214fd7d65ef8bdd9344f5c1daf6df2e0550a07611aa617",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "f004eadd708c9243aea6667e683451b29921b6cec45d1aec9bf63b4b49493b13",
-    "data/cve-catalog.json": "deddba50e7f8d16528b04007715a1574211d058afc403d36c475ca8380e89eec",
-    "data/cwe-catalog.json": "4a11ae07ebfb69c9f7321a51468d36335cfa42f7c049d24439e39ed99fda18d8",
+    "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
+    "data/cve-catalog.json": "d4632abe8bda7993fcdefbb586e1ba7139c55e22a871b2bb167703fb9c00392c",
+    "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
-    "data/framework-control-gaps.json": "8ddc65d007fd67c9f6ef3a9f818b09e8025af72d59532a4785bdba956dd01dfd",
+    "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "a8fec7dd4cc7fd2b817d593c07e697b94f32628d9b197a4d7d3d9bafda7754a4",
+    "data/zeroday-lessons.json": "fc805929c375a3e4dfafaa5fdde9a54fd203ac3c44c1b02ae76e4aa9f7e82d62",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1741,
+    "chains_cve_entries": 1745,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1754
+      "entry_count": 1758
     },
     {
       "date": "2026-09-27",
@@ -19,7 +19,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1754
+      "entry_count": 1758
     },
     {
       "date": "2026-09-22",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1754,
+      "entry_count": 1758,
       "sample_keys": [
-        "CVE-2021-20021",
-        "CVE-2021-20016",
-        "CVE-2026-93952",
-        "CVE-2021-31207",
-        "CVE-2021-34473"
+        "CVE-2021-1905",
+        "CVE-2021-20022",
+        "CVE-2021-22893",
+        "CVE-2021-38645",
+        "CVE-2021-20021"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1754,
+      "entry_count": 1758,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 36349248 bytes
-sha256: aa2128b2d2b717ec78e2dd26148720fb46f398583a8971780939aafb00ca09ea
+size: 36422355 bytes
+sha256: fa9a606edd2ae06b45c401d62fb46cd219bd81d3b46d5d62a107be315185839b

package/data/attack-techniques.json

@@ -328,6 +328,7 @@
       "CVE-2020-2883",
       "CVE-2020-4428",
       "CVE-2020-8218",
+      "CVE-2021-20022",
       "CVE-2021-20035",
       "CVE-2021-26084",
       "CVE-2021-27102",
@@ -889,6 +890,7 @@
       "CVE-2021-1048",
       "CVE-2021-1647",
       "CVE-2021-1782",
+      "CVE-2021-1905",
       "CVE-2021-21551",
       "CVE-2021-22555",
       "CVE-2021-22600",
@@ -926,6 +928,7 @@
       "CVE-2021-36948",
       "CVE-2021-37973",
       "CVE-2021-38003",
+      "CVE-2021-38645",
       "CVE-2021-38648",
       "CVE-2021-38649",
       "CVE-2021-39793",
@@ -2003,6 +2006,7 @@
       "CVE-2021-1498",
       "CVE-2021-20016",
       "CVE-2021-20021",
+      "CVE-2021-20022",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20038",
@@ -2021,6 +2025,7 @@
       "CVE-2021-22502",
       "CVE-2021-22506",
       "CVE-2021-22681",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-22986",
       "CVE-2021-22991",
@@ -3900,6 +3905,7 @@
       "CVE-2016-6366",
       "CVE-2018-0147",
       "CVE-2019-11580",
+      "CVE-2021-22893",
       "CVE-2021-35587",
       "CVE-2021-44077",
       "CVE-2022-23134",
@@ -11885,6 +11891,7 @@
       "CVE-2021-35394",
       "CVE-2021-35464",
       "CVE-2021-36260",
+      "CVE-2021-38645",
       "CVE-2021-38647",
       "CVE-2021-38648",
       "CVE-2021-38649",
@@ -15523,6 +15530,8 @@
       "CVE-2020-1938",
       "CVE-2020-28949",
       "CVE-2020-36193",
+      "CVE-2021-20022",
+      "CVE-2021-22893",
       "CVE-2021-22941",
       "CVE-2021-23758",
       "CVE-2021-26084",