@blamejs/exceptd-skills 0.21.6 → 0.21.7

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.21.7 — 2026-09-27
+
+The catalog holds 1,758 CVEs after one addition from CISA KEV: CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU driver on Android and other Snapdragon devices. It has no public exploit, and the fix needs a device restart. Google's Threat Analysis Group attributes its use as a zero-day to the commercial surveillance vendor Intellexa.
+
+Four Qualcomm entries now include their CVE id in the title, because CISA gives them the same name: the new CVE-2021-1905 and the existing CVE-2022-22071, CVE-2023-33063 and CVE-2025-27038.
+
+The framework gap for Australian ISM control ISM-0298 now also covers the check that an applied update carries the fix for a given vulnerability, such as an Android device whose security patch level is not one the vendor's bulletin lists the fix under. Its theater test asks for that evidence for one remediated CVE, and CVE-2021-1905 is the gap's first evidence entry.
+
 ## 0.21.6 — 2026-09-27
 
 The catalog holds 1,757 CVEs after three additions from CISA KEV: CVE-2021-22893, an authentication bypass in Pulse Connect Secure, CVE-2021-20022, an arbitrary file upload in SonicWall Email Security, and CVE-2021-38645, a local privilege escalation in Microsoft's Open Management Infrastructure. None has a public exploit. The Pulse Connect Secure and SonicWall flaws carry CISA's ransomware designation and need a restart before the fix takes effect.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T16:35:06.498Z",
+  "generated_at": "2026-09-27T17:35:13.161Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "bba4a92806445f7adb97598feb6485976857b6258d09ab4edd3ba9ed2601688e",
+    "manifest.json": "1a53c846b758ff96c4214fd7d65ef8bdd9344f5c1daf6df2e0550a07611aa617",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "1c8e3ee0e5e2c0c81bdc753b77caae46d45fd668d676e0a17febc5e50217993f",
-    "data/cve-catalog.json": "5c568853f271d879d23d756d425155c2e8018c3cfde6ce5e9d3c709cefb2f0b1",
-    "data/cwe-catalog.json": "e278adafce665dfe8475c05f4c6e9051e70a3100b2ce340e671a27547bcc0582",
+    "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
+    "data/cve-catalog.json": "d4632abe8bda7993fcdefbb586e1ba7139c55e22a871b2bb167703fb9c00392c",
+    "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
-    "data/framework-control-gaps.json": "f6857c6dae6f6a863d80f05ac0c056be2290d91d5b0371e6be5e66525d9e78f0",
+    "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "21d9bb3092858a41817cf1b7284c9c6e3bf26aedb7aaaf18011bdbb6ba618ff4",
+    "data/zeroday-lessons.json": "fc805929c375a3e4dfafaa5fdde9a54fd203ac3c44c1b02ae76e4aa9f7e82d62",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1744,
+    "chains_cve_entries": 1745,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1757
+      "entry_count": 1758
     },
     {
       "date": "2026-09-27",
@@ -19,7 +19,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1757
+      "entry_count": 1758
     },
     {
       "date": "2026-09-22",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1757,
+      "entry_count": 1758,
       "sample_keys": [
+        "CVE-2021-1905",
         "CVE-2021-20022",
         "CVE-2021-22893",
         "CVE-2021-38645",
-        "CVE-2021-20021",
-        "CVE-2021-20016"
+        "CVE-2021-20021"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1757,
+      "entry_count": 1758,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 36405496 bytes
-sha256: 1f21de50a9f778f00e23953a3541bde6f506a7ef702783c5b5a77400fac56985
+size: 36422355 bytes
+sha256: fa9a606edd2ae06b45c401d62fb46cd219bd81d3b46d5d62a107be315185839b

package/data/attack-techniques.json

@@ -890,6 +890,7 @@
       "CVE-2021-1048",
       "CVE-2021-1647",
       "CVE-2021-1782",
+      "CVE-2021-1905",
       "CVE-2021-21551",
       "CVE-2021-22555",
       "CVE-2021-22600",

package/data/cve-catalog.json

@@ -93,6 +93,115 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2021-1905": {
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-416"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables",
+    "epss_score": 0.01543,
+    "epss_percentile": 0.73939,
+    "epss_date": "2026-09-26",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-1905",
+    "vendor_advisories": [
+      {
+        "vendor": "Qualcomm",
+        "advisory_id": "may-2021-bulletin",
+        "url": "https://web.archive.org/web/20220324012231/https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin",
+        "severity": "high",
+        "published_date": "2021-05-03"
+      },
+      {
+        "vendor": "Google",
+        "advisory_id": "2021-05-01",
+        "url": "https://source.android.com/docs/security/bulletin/2021-05-01",
+        "severity": "high",
+        "published_date": "2021-05-03"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-1905",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.",
+    "type": "use-after-free-gpu-driver-lpe",
+    "blast_radius": 20,
+    "poc_available": false,
+    "poc_description": "No hosted working exploit for this CVE was found. Google Project Zero published a root-cause analysis of CVE-2021-1905 whose Proof-of-concept and Exploit sample fields both read N/A and which states the analysts did not have access to the exploit sample. The Exploit-DB index, the Metasploit framework repository and the ProjectDiscovery nuclei templates repository hold no entry for this CVE. The only GitHub repository that names it, https://github.com/TAKIANFIF/CVE-2021-1905-CVE-2021-1906-CVE-2021-28663-CVE-2021-28664, is empty and holds no code. What is documented is analysis and vendor and platform advisories, not obtainable exploit code.",
+    "iocs": {
+      "behavioral": [
+        "Any local process, including an untrusted app or a browser process, repeatedly opening the Qualcomm graphics device and forking children after opening the KGSL file descriptor so multiple processes share one GPU mapping, consistent with attempts to trigger the use-after-free",
+        "A local process racing two mappings of the same GPU memory at once, then reusing the freed GPU mapping structure, followed by activity that runs with elevated privileges on the device",
+        "Any local process, including an installed app or a browser process, gaining kernel-level privileges shortly after heavy or unusual use of the GPU memory-mapping interface"
+      ],
+      "network": [],
+      "host": [
+        "An Android device on an affected Qualcomm chipset whose security patch level is earlier than 2021-05-05, which includes a device that reports 2021-05-01",
+        "A Qualcomm Snapdragon chipset from the affected list (spanning Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables) reported in the Qualcomm May 2021 bulletin as affected by CVE-2021-1905",
+        "Local access to the Qualcomm Adreno GPU kernel driver (the KGSL interface) by an untrusted process, which is the precondition for triggering the flaw"
+      ],
+      "_ioc_source_note": "The use-after-free mechanism, that a GPU shared mapping with multiple virtual memory areas and a race in the driver's unmapped-area path leave a freed mapping structure reachable, was read from Google Project Zero's root-cause analysis at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html. That analysis gives the Android 2021-05-01 security patch level as the first patched version, but the Android Security Bulletin for May 2021, archived at https://web.archive.org/web/20260917102124/https://source.android.com/docs/security/bulletin/2021-05-01, lists CVE-2021-1905 under the 2021-05-05 security patch level, so the patch-level indicator follows the bulletin. The limited, targeted exploitation statement was read from the same bulletin. The affected chipset list, the High rating and the codeaurora patch reference were read from the Qualcomm May 2021 bulletin as archived at https://web.archive.org/web/20220324012231/https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin. All host and behavioral items are general hunting heuristics derived from the mechanism, not artifacts read from an exploit sample; the flaw requires local code execution and has no network indicators. Google TAG's Buying Spying report at https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors_-_TAG_report.pdf attributes 0-day use of this CVE against Android to the tooling of the commercial surveillance vendor Intellexa. No actor infrastructure, file hash or C2 address is listed, because that report names this CVE only in its appendix table and ties no infrastructure, hash or address to it, and no other source consulted ties any of them to this exploit."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Google Project Zero's root-cause analysis lists the reporter as N/A and did not have the exploit sample; no source consulted names a party that found or reported the flaw, and no AI tooling is claimed.",
+    "ai_discovery_source": "unknown",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-1905 (CWE-416, CVSS 7.8) + CISA KEV (added 2021-11-03) + Qualcomm May 2021 security bulletin; no source names the finder, and the Project Zero analysis records the reporter as N/A.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-1905 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware use as Unknown; its forensicTriage flag is No and the required action is to apply updates per vendor instructions. The Android Security Bulletin for May 2021 states there are indications that CVE-2021-1905, together with CVE-2021-1906, CVE-2021-28663 and CVE-2021-28664, may be under limited, targeted exploitation. Google TAG's February 2024 report Buying Spying: Insights into Commercial Surveillance Vendors lists CVE-2021-1905 (Qualcomm Adreno GPU, exploited against Android) in its appendix table of commercial surveillance vendors' products and known 0-day exploits, under the vendor Intellexa, which the table lists with the alias Cytrox and with products including the ALIEN stager and the PREDATOR spyware. The report names CVE-2021-1905 only in that table and gives no campaign dates, targets or exploit chain for it.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SC-39": "SC-39 requires the system to maintain a separate execution domain for each executing system process. In the Qualcomm GPU design, several processes can share one GPU address space, such as a child forked after the KGSL file descriptor is opened, so their mappings share one kgsl_mem_entry on which the driver holds no lock, and CVE-2021-1905 is triggered by a state error on that shared structure followed by a race between two such processes mapping it at the same time. An SC-39 assessment of separation between operating-system processes does not test per-process state that a device driver shares across processes by design.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and, in cases where a patch is not available, requires additional measures with the residual risk accepted, without naming those measures. For CVE-2021-1905 the fix is in the Android 2021-05-05 security patch level, and a handset receives it only when its maker ships that level, so an in-scope entity can hold affected devices for which no patch is available; 6.6.1 does not name gating access on the 2021-05-05 level as an additional measure for that period.",
+      "UK-CAF-B4": "CAF outcome B4.d at Achieved expects announced vulnerabilities for all software packages, network and information systems supporting an essential function to be tracked, prioritized and mitigated, for example by patching, promptly. The Partially achieved level requires prompt mitigation only for externally exposed vulnerabilities and allows some vulnerabilities that are not externally exposed to have temporary mitigations for an extended period. CVE-2021-1905 is a local flaw reached by any local code execution, including an earlier exploit in a chain, so an organization assessed at Partially achieved can keep it under an extended temporary mitigation, such as restricting untrusted app installation, which does not stop a chain that starts with a remote exploit, although the Android Security Bulletin for May 2021 reported indications of limited, targeted exploitation. At Achieved, \"promptly\" is not defined for a flaw whose fix a handset can install only after its maker ships the 2021-05-05 security patch level.",
+      "AU-ISM-0298": "ISM-0298 requires a centralized and managed approach that maintains the integrity of patches or updates and confirms that they have been applied successfully, for applications, operating systems, drivers and firmware. The Android Security Bulletin for May 2021 splits the month into a 2021-05-01 and a 2021-05-05 security patch level and lists this Qualcomm GPU driver fix only under 2021-05-05, so a confirmation that a device's May 2021 update applied successfully passes a device that reports 2021-05-01 and still carries CVE-2021-1905. ISM-0298 checks that an update was applied, not that the applied update contains the fix for a given vulnerability.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken, and it sets no timescale for those measures. For CVE-2021-1905 the Android Security Bulletin for May 2021 reported indications of limited, targeted exploitation, and a handset can install the fix only after its maker ships the 2021-05-05 security patch level, so A.8.8 leaves how long affected devices may stay exposed to a timescale each organization sets for itself."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live patch exists; the fix is delivered as an operating-system security update that requires a device reboot to apply. Qualcomm published the fix in its May 2021 bulletin with a patch referenced on codeaurora, and on Android it is carried by the 2021-05-05 security patch level, not the 2021-05-01 level, but it reaches a given device only when its maker ships the corresponding update, so patch availability from Qualcomm does not mean every affected device can yet install it.",
+    "affected": "Multiple Qualcomm Snapdragon chipsets using the Adreno GPU kernel driver, across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables. An untrusted local process on the device can trigger a use-after-free in the GPU memory-mapping path, which the CVSS vectors from NVD and Qualcomm rate as high impact to confidentiality, integrity and availability.",
+    "affected_versions": [
+      "Qualcomm chipsets listed in the May 2021 security bulletin as affected by CVE-2021-1905, spanning the Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables families",
+      "On Android, devices below the 2021-05-05 security patch level are affected, including devices that report 2021-05-01; the Android Security Bulletin for May 2021 lists this fix only in the 2021-05-05 patch level",
+      "On Android devices, including wearables and automotive units that run Android and report an Android security patch level, a device can install the fix only after its maker ships an update carrying the 2021-05-05 patch level; on devices that report no Android security patch level, the fix is the maker's update that integrates Qualcomm's May 2021 fix for CVE-2021-1905 (Android bug A-178809945, Qualcomm QC-CR#2826864). Project Zero and Qualcomm's bulletin give the fix commits in Qualcomm's msm-4.9 kernel tree: d236d315145f8250523ce9e14897d62e5d6639fc, the patch Qualcomm's bulletin lists, and ec3c8cf016991818ca286c4fd92255393c211405, which Project Zero also ties to this flaw; those two ids are the reference only for kernels built from msm-4.9"
+    ],
+    "vendor_update_paths": [
+      "On Android devices, including wearables and automotive units that run Android and report an Android security patch level, install the maker's update that brings the device to the 2021-05-05 security patch level or later, which requires a device reboot; a device that reports 2021-05-01 does not carry this fix. The underlying Qualcomm fix is published in the May 2021 security bulletin with a patch referenced on codeaurora.",
+      "On devices built on the affected chipsets that report no Android security patch level, install the device maker's update that integrates Qualcomm's May 2021 fix for CVE-2021-1905, and check the chipset against the affected list in Qualcomm's May 2021 security bulletin. Where such a device runs a Linux kernel with Qualcomm's KGSL graphics driver, confirm with the maker that the update integrates Qualcomm's fix for CVE-2021-1905 (Android bug A-178809945, Qualcomm QC-CR#2826864), including the locking change Project Zero describes. For a kernel built from Qualcomm's msm-4.9 tree, the reference is the two commits Project Zero considers relevant: d236d315145f8250523ce9e14897d62e5d6639fc, the one Qualcomm's bulletin lists, and ec3c8cf016991818ca286c4fd92255393c211405, the locking change the bulletin does not list. Those ids are given for the msm-4.9 tree, so do not treat their absence from a kernel built from another Qualcomm tree as a missing fix.",
+      "For a managed fleet, gate access to organizational data on the device meeting the 2021-05-05 security patch level and quarantine devices that cannot reach it, since the platform fix depends on each maker shipping an update.",
+      "Where a device maker has not yet shipped the fix, restrict installation of untrusted applications, since the flaw requires local code execution to reach the GPU driver. That restriction does not stop an exploit chain that gains code execution through the browser, so for users who fit a spyware targeting profile, also replace or retire devices that cannot reach the 2021-05-05 security patch level, or keep them away from organizational data."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 55,
+    "rwep_notes": "RWEP 55. cisa_kev +25, active_exploitation +20, blast_radius +20, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
   "CVE-2021-20022": {
     "name": "SonicWall Email Security Unrestricted Upload of File Vulnerability",
     "cvss_score": 7.2,
@@ -97685,7 +97794,7 @@
     "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2023-33063": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2023-33063)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -97776,7 +97885,7 @@
     "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2022-22071": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2022-22071)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -167136,7 +167245,7 @@
     "last_verified": "2026-08-22"
   },
   "CVE-2025-27038": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2025-27038)",
     "type": "memory-corruption",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",

package/data/cwe-catalog.json

@@ -1877,6 +1877,7 @@
       "CVE-2020-9715",
       "CVE-2021-0920",
       "CVE-2021-1048",
+      "CVE-2021-1905",
       "CVE-2021-21193",
       "CVE-2021-21206",
       "CVE-2021-22893",

package/data/framework-control-gaps.json

@@ -3886,6 +3886,7 @@
       "CVE-2021-1870",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
@@ -5270,6 +5271,7 @@
       "CVE-2021-1789",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-21148",
@@ -6245,6 +6247,7 @@
       "CVE-2020-0986",
       "CVE-2020-17087",
       "CVE-2021-1782",
+      "CVE-2021-1905",
       "CVE-2021-22600",
       "CVE-2021-25370",
       "CVE-2021-28664",
@@ -12810,6 +12813,7 @@
       "CVE-2021-1789",
       "CVE-2021-1870",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20022",
       "CVE-2021-20028",
@@ -14870,12 +14874,15 @@
     "misses": [
       "Software that updates itself (browsers, agents, desktop applications, device firmware) fetches and applies updates outside any centralised system, so the integrity check the control requires never runs on those updates",
       "Integrity is usually taken to mean the vendor's signature verified, which does not detect a signed update from a compromised build system or a rollback to an older signed build",
-      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published"
+      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published",
+      "Confirmation that an update applied does not show that it carries the fix for a given vulnerability: an Android device can apply its monthly update successfully and report a security patch level that the vendor's bulletin does not list the fix under"
     ],
-    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact.",
+    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact. For each vulnerability being remediated, the evidence must also show that the installed build or security patch level is one the vendor lists the fix under, not only that an update applied.",
     "status": "open",
     "opened_date": "2026-09-22",
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2021-1905"
+    ],
     "atlas_refs": [],
     "attack_refs": [
       "T1195.002",
@@ -14883,16 +14890,15 @@
     ],
     "theater_test": {
       "claim": "Our patches and updates keep their integrity and are confirmed applied, which satisfies ISM-0298.",
-      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Theater verdict if the evidence covers only centrally deployed patches, or if any self-updating product has no documented integrity check.",
+      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Then pick one remediated CVE and confirm the record shows an installed build or security patch level that the vendor lists its fix under. Theater verdict if the evidence covers only centrally deployed patches, if any self-updating product has no documented integrity check, or if the remediated CVE is recorded as fixed on the strength of an applied update alone.",
       "evidence_required": [
         "inventory of self-updating software on a sampled host",
         "per-product record of signature verification and rollback protection",
-        "post-install artifact comparison for one sampled update"
+        "post-install artifact comparison for one sampled update",
+        "for one remediated CVE, the installed build or security patch level compared with the level the vendor lists its fix under"
       ],
       "verdict_when_failed": "compliance-theater"
-    },
-    "forward_looking": true,
-    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+    }
   },
   "AU-ISM-1240": {
     "framework": "Australian Government Information Security Manual (ISM)",

package/data/zeroday-lessons.json

@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 1757
+    "entry_count": 1758
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -28139,7 +28139,7 @@
     ]
   },
   "CVE-2025-27038": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2025-27038)",
     "lesson_date": "2026-05-29",
     "attack_vector": {
       "description": "a use-after-free (CWE-416) in the Qualcomm Adreno GPU driver, exploited by a local foothold to escalate privilege on the device. CISA KEV-listed 2025-06-03 with confirmed in-the-wild exploitation; LPEs of this class are routinely paired with an initial-access primitive.",
@@ -145717,5 +145717,85 @@
         ]
       }
     ]
+  },
+  "CVE-2021-1905": {
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)",
+    "lesson_date": "2026-09-26",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "unknown",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "The Qualcomm Adreno GPU kernel driver mishandles GPU memory mappings shared by multiple processes: a shared mapping with several virtual memory areas plus a race between two processes mapping the same GPU memory leaves a freed mapping structure reachable. Project Zero did not have the exploit sample and writes that it is hard to say whether the attack used classical memory corruption through the freed object or a GPU-specific route, such as granting an attacker-controlled GPU context arbitrary physical memory read and write; the CVSS vectors rate the impact as high for confidentiality, integrity and availability.",
+      "privileges_required": "local; the attacker needs code execution in any unprivileged local process on the device, such as a malicious installed app or a process compromised by an earlier exploit in a chain, for example a remote-code-execution and sandbox-escape pair. Google TAG's Buying Spying report describes spyware-vendor exploit chains in which a local privilege escalation is usually the final step, after a remote-code-execution exploit and a sandbox escape.",
+      "complexity": "low per the CVSS vectors from NVD and Qualcomm (AC:L); the trigger is a state error in kgsl_gpumem_vm_close followed by a race between two processes in kgsl_get_unmapped_area",
+      "ai_factor": "None. No AI tooling is claimed and no finder is named."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Applying the Android 2021-05-05 security patch level, or on other platforms the maker's update that integrates the Qualcomm driver fix, on affected devices, which corrects the GPU memory-mapping handling that allows the use-after-free",
+        "was_this_required": true,
+        "framework_requiring_it": "ASD ISM-1878, which applies to operating systems of IT equipment other than workstations, servers and network devices, including handsets: patches are applied within 48 hours of release when the vendor rates the flaw critical or a working exploit exists",
+        "adequacy": "The patch removes the flaw, but it reaches a device only when its maker ships the update, so on a fleet prevention depends on OEM rollout that can lag the platform fix while targeted exploitation is reported."
+      },
+      "detection": {
+        "what_would_have_worked": "Watching for any local process, including an untrusted app or a browser process, making heavy use of the GPU memory-mapping interface and forking to share GPU mappings, and for a local process gaining kernel privilege, using on-device telemetry",
+        "was_this_required": false,
+        "framework_requiring_it": "NIST-800-53-SC-39",
+        "adequacy": "Kernel-escalation signals are hard to observe on mobile endpoints, and the race-based trigger has no network footprint, so detection is weak compared with keeping devices at the fixed patch level."
+      },
+      "response": {
+        "what_would_have_worked": "Bringing affected devices to the 2021-05-05 patch level and rebooting, and quarantining devices that cannot reach it from organizational data until their maker ships the update. For a device of a user who fits a commercial-spyware targeting profile and that ran a security patch level below 2021-05-05, also assessing the device for compromise and capturing evidence before it is reset or reissued.",
+        "was_this_required": false,
+        "framework_requiring_it": "NIS2-Art21-patch-management",
+        "adequacy": "Enforcing the fixed patch level closes the flaw on devices that can install the fix, but installing the update does not show whether a device was compromised before it was updated. Google TAG attributes 0-day use of this flaw against Android to the commercial surveillance vendor Intellexa, so for devices of users who fit a spyware targeting profile, patching without a compromise assessment can leave an earlier compromise undetected."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SC-39": {
+        "covered": true,
+        "adequate": false
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false
+      },
+      "AU-ISM-0298": {
+        "covered": true,
+        "adequate": false
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-126",
+        "name": "MOBILE-OS-MINIMUM-PATCH-LEVEL-ENFORCEMENT",
+        "description": "Access to organizational data from a managed mobile device depends on the device meeting a minimum operating-system security-patch level that carries the fix, and devices below it are blocked or quarantined rather than accepted on a compliance dashboard.",
+        "evidence": "The Android Security Bulletin for May 2021 lists CVE-2021-1905 under the 2021-05-05 security patch level, not the 2021-05-01 level, and Qualcomm's May 2021 bulletin says OEMs were notified and strongly recommended to release patches on end devices. Gating organizational-data access on a device reporting 2021-05-05 or later, and quarantining devices that report an earlier level, including 2021-05-01, closes the fleet exposure until each device's maker ships that level.",
+        "gap_closes": [
+          "UK-CAF-B4",
+          "ISO-27001-2022-A.8.8",
+          "NIS2-Art21-patch-management",
+          "AU-ISM-0298"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-003",
+        "name": "KERNEL-EXPLOITATION-DETECTION",
+        "description": "Host-level detection rules for privilege-escalation indicators are deployed and alert within seconds, so exploitation of a local escalation flaw is observed even before the fix is installed.",
+        "evidence": "The Android Security Bulletin for May 2021 reports indications that CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU kernel driver reached by a local process, may be under limited, targeted exploitation. Google Project Zero's root-cause analysis says runtime anomaly detection might be one way to detect similar 0-days but would require specialist tooling, so on-device detection is a compensating signal only where that tooling is deployed on devices that do not yet carry the 2021-05-05 security patch level.",
+        "gap_closes": [
+          "NIST-800-53-SC-39",
+          "ISO-27001-2022-A.8.8"
+        ]
+      }
+    ]
   }
 }

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.21.6",
+  "version": "0.21.7",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "qF31mqZPI8ZUuuVXnV05yptx+4lZe5YX6IKIybbaqHdCQ2ELUusjgRA6Hm/G2T89mpM3iCIdnKUmUkd9A6nPDw==",
-      "signed_at": "2026-09-27T16:35:05.292Z",
+      "signed_at": "2026-09-27T17:35:11.847Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -134,7 +134,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "lwK5zyS1/TyNp0/Hh2ldlto8r0Tj0P6XWs0U0pSGjbMq7ldNnnUJDe1oLCWwvTj/fcTGPLOt51ZBGlGlGugBDA==",
-      "signed_at": "2026-09-27T16:35:05.294Z",
+      "signed_at": "2026-09-27T17:35:11.849Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -217,7 +217,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "+zW0ui2tPBoE69HFEuTHzLJkPJD3KLpDCL1murk1N+ALuWEtx/ApgS7eZVH7BsLxVv/uHmmmfw+Uu5cNhrmQAw==",
-      "signed_at": "2026-09-27T16:35:05.294Z",
+      "signed_at": "2026-09-27T17:35:11.849Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -271,7 +271,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "zf55d/qt6fVGaqsYT1LnlcAUVcwh2qs/WBdwdAFU4pwTRp540sQoJNEo/8EPNwsCZKKwY6IOJlkMXLy/kyGRCg==",
-      "signed_at": "2026-09-27T16:35:05.294Z"
+      "signed_at": "2026-09-27T17:35:11.849Z"
     },
     {
       "name": "compliance-theater",
@@ -303,7 +303,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "osyCDCgT1mJoZjiodGsO/Q6ze65er7LWcMbBDcNXLPIuxpYONSnuUrKrG0kZmbVJMOdK5Jte+BOTkDbCYOsSAA==",
-      "signed_at": "2026-09-27T16:35:05.295Z"
+      "signed_at": "2026-09-27T17:35:11.850Z"
     },
     {
       "name": "exploit-scoring",
@@ -334,7 +334,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "p4h5ex1KPndY88cMmafXzZoz3idfI7TsdMxajjGmxPC43ZNaFnfDNfhrkQlTo42VJ+8N27ZyYNwuTCk1RtJ8Dg==",
-      "signed_at": "2026-09-27T16:35:05.296Z"
+      "signed_at": "2026-09-27T17:35:11.850Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -376,7 +376,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "NSpytlrXh1+o4sX0EqZ746eAm3+mPfl0hgpgE5YHAMcvosOu1icbZ2aR424GrB5rASr7c/5fo+olZcBA4qx9CQ==",
-      "signed_at": "2026-09-27T16:35:05.296Z",
+      "signed_at": "2026-09-27T17:35:11.851Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -443,7 +443,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "/bIjyOG3vcL6sMPX0agXTVCO2Wd6/6/PBMQfjALT63ojxXMwBDz4HQTO00OSkNgvCLTOvcUM4nN4H+4yl+roCg==",
-      "signed_at": "2026-09-27T16:35:05.297Z",
+      "signed_at": "2026-09-27T17:35:11.851Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -484,7 +484,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "Q40RkYhyDuzaOX02Oy/UOYEIbWMG7Jj2AIiSeUjZLrHJZcQJMsQG0YQN1/tPtzuTwip1oXf69gAe/PHuz7/uBQ==",
-      "signed_at": "2026-09-27T16:35:05.297Z",
+      "signed_at": "2026-09-27T17:35:11.851Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -519,7 +519,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "ip/6xTNuHUcdPjPQW8TFLWatHGffymsi0xHgb/Hv/umC3GpQciVWUIp0pUJ2dlnuBnmd72IjDSvpVrQZjSzPCQ==",
-      "signed_at": "2026-09-27T16:35:05.297Z",
+      "signed_at": "2026-09-27T17:35:11.852Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -560,7 +560,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
       "signature": "u/3QUr3Nh0q1tjOaHQ3yC4WIJOUoABr+6R8VStCgS4NvNBglb/JcbLYvQmFixqdURu4Qi6xtqvUw0E14b5mtDA==",
-      "signed_at": "2026-09-27T16:35:05.298Z",
+      "signed_at": "2026-09-27T17:35:11.852Z",
       "d3fend_refs": [
         "D3-EAL",
         "D3-EFA",
@@ -602,7 +602,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-18",
       "signature": "5+DC+gAxjBkgM8OjirB3yDpcSOWSiii2zuEH1ue3VDdlvfvVrLF8ysRHUHg0AYC4Y9lByy5xJb1UWz1xnRqmAw==",
-      "signed_at": "2026-09-27T16:35:05.298Z",
+      "signed_at": "2026-09-27T17:35:11.853Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -671,7 +671,7 @@
       ],
       "last_threat_review": "2026-08-05",
       "signature": "r8tW6PJ8G0Sjd9nyr6rWJ11dovdH9llEe6eAldHedUKRl+vdbQd4g5Cefs2Q/xcNzoXGh3C0usNLX8jX4EaWBQ==",
-      "signed_at": "2026-09-27T16:35:05.299Z",
+      "signed_at": "2026-09-27T17:35:11.853Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -721,7 +721,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "R9cbLm2pz1MupiQpWk3CtrnlZ06VQQ5gN5MWlMEbF+aFTHdK7JsSXoyLodZYDo1U+ROQ+4OH2VXo0Z+54k/KBw==",
-      "signed_at": "2026-09-27T16:35:05.299Z"
+      "signed_at": "2026-09-27T17:35:11.854Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -761,7 +761,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "n9Emv3t+W3lhOPkrLI06Grwx9lDVdHVYT6KMXcLHGnJiTLiSrz23XWIdpJQNMjj7Prp6TFaDScZ6x6WkZuxHDA==",
-      "signed_at": "2026-09-27T16:35:05.300Z",
+      "signed_at": "2026-09-27T17:35:11.854Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -815,7 +815,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-09-09",
       "signature": "Lb71p2XDRGmSUe4LGxiMl5HgJQ6gOVvWhjZ24dz8eBt7q+9qb0dLMMXshsfmreTjRU4ArNv50QPLZFFh9l+HCw==",
-      "signed_at": "2026-09-27T16:35:05.300Z"
+      "signed_at": "2026-09-27T17:35:11.854Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -891,7 +891,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "tBzI4lHl8F2+MeDZIOak1IYUBy8rrbgbc7M5uvodJXBKs+Rj9BmC0quk3NEcNRma8eIawUyyjU5ieFMi5MpiBQ==",
-      "signed_at": "2026-09-27T16:35:05.300Z"
+      "signed_at": "2026-09-27T17:35:11.855Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -952,7 +952,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "1rpQIBRamlNF6gFGwycmgGLcmNalYeAZjkRKdQ0NWQW1lXQegE4sTObgDFkKCLuLSB+6j3zjzinwSQyxwxL9Dw==",
-      "signed_at": "2026-09-27T16:35:05.301Z"
+      "signed_at": "2026-09-27T17:35:11.855Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -1030,7 +1030,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "wKN08ODL/5Z1Kr1ySnDqj/eWY013y13LRqupqEERjMLjKMxuFiC6cLUaPjUyachML0PZAZrWYlCdfrggbNxkDg==",
-      "signed_at": "2026-09-27T16:35:05.301Z"
+      "signed_at": "2026-09-27T17:35:11.855Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1114,7 +1114,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "fZ7VVjKFgQsgNNQd6m71lLY+POS/85jSZopbDwC96M+SfqSCQGW+6F9CqOhjE9vwkxoKhaKRULTfhpdbcsHhBg==",
-      "signed_at": "2026-09-27T16:35:05.301Z"
+      "signed_at": "2026-09-27T17:35:11.856Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1171,7 +1171,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "W8kg2Okd/VF521VmeVFGK2TmXkFPycuwgYdyNxLU2fMN+sR9Aals/X+Xqr/prrGEsqWnZsCInSq1TYzFr0wiDg==",
-      "signed_at": "2026-09-27T16:35:05.302Z"
+      "signed_at": "2026-09-27T17:35:11.856Z"
     },
     {
       "name": "identity-assurance",
@@ -1245,7 +1245,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-09-27T16:35:05.303Z"
+      "signed_at": "2026-09-27T17:35:11.857Z"
     },
     {
       "name": "ot-ics-security",
@@ -1304,7 +1304,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-09-18",
       "signature": "2pmqMIfqL1VAK5ZzPY4l1wllI7tnl5ne7ML6u9qQnA3SScRR1++TPUjEaB3iLZeRanCKGgkMj8LmU96dbqYYDA==",
-      "signed_at": "2026-09-27T16:35:05.303Z"
+      "signed_at": "2026-09-27T17:35:11.857Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1364,7 +1364,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "FfzagIXtJNegSNPjLSI11fnQqxXJ4nSfPcv+IdbD3XmIfDTxnV7nTAR0tCQKqOGKpsyYEwAZP5jQzA3tIuJJBw==",
-      "signed_at": "2026-09-27T16:35:05.304Z"
+      "signed_at": "2026-09-27T17:35:11.858Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1418,7 +1418,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "0njaUBtRgD+5ys5xh1x+daPI2xhnHzZP+pielUdqEndR2/uDAuf3XIDUWnhC8LKr+33HSX3pXmqfgbXJpyqxBQ==",
-      "signed_at": "2026-09-27T16:35:05.304Z"
+      "signed_at": "2026-09-27T17:35:11.858Z"
     },
     {
       "name": "webapp-security",
@@ -1501,7 +1501,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "YhdXy2fMZubdoGemwvt8XCPFaMpcA3uVzGlGH7j+3koPuPl99VqkD1Q2gsJjs894V3CiRSWuRU75q4nIGwUAAQ==",
-      "signed_at": "2026-09-27T16:35:05.304Z",
+      "signed_at": "2026-09-27T17:35:11.858Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1562,7 +1562,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "+x25rPi9K6Yo39Nj9ZN+PV4y0yQ9z9mNmOrBISYLsWrjqVTACCUFI+mp4w/nV6sZueEMoiar+inwE/fucbuiDw==",
-      "signed_at": "2026-09-27T16:35:05.305Z"
+      "signed_at": "2026-09-27T17:35:11.859Z"
     },
     {
       "name": "sector-healthcare",
@@ -1630,7 +1630,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "XMI/ZJn07vHRmN+zRCbYh+JH0bUaRL0KpthMVfRXGz3ELqQqeLG7eUrrnBWnJ5GhsWTuYY/dGCyDdsVyBKtNDA==",
-      "signed_at": "2026-09-27T16:35:05.305Z"
+      "signed_at": "2026-09-27T17:35:11.859Z"
     },
     {
       "name": "sector-financial",
@@ -1719,7 +1719,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "gFUmQCkAfdW++Mb+UcwHTATJcZuszFA3dQSD+v3asEdYYsSFt63L03p09Y3JWN0c4JS4jAC1x08WsgYSklSCBQ==",
-      "signed_at": "2026-09-27T16:35:05.305Z"
+      "signed_at": "2026-09-27T17:35:11.859Z"
     },
     {
       "name": "sector-federal-government",
@@ -1796,7 +1796,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "eFY8sPJCCqYTLGKx+1Spc8UhXNF5Lg3PxN11++lGHBEtPJf/HWeLtrrw2CZSabeqZxdrSLEjuiJxkFo9r+VkAg==",
-      "signed_at": "2026-09-27T16:35:05.306Z"
+      "signed_at": "2026-09-27T17:35:11.860Z"
     },
     {
       "name": "sector-energy",
@@ -1870,7 +1870,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "tpbR4Azrmbh9YSByEBqsb40/c6e17bKw6RDYzdW1P1gK31g+It5wOCgVvoacCv4F5SjQWIQnlrm1QWTMYYJWAA==",
-      "signed_at": "2026-09-27T16:35:05.306Z"
+      "signed_at": "2026-09-27T17:35:11.860Z"
     },
     {
       "name": "sector-telecom",
@@ -1956,7 +1956,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "G7WrqBaR/Nqf4zhYdS69gBsunZJolx0saEAAd6Y+3ev8iN7mDiB5H0W+ow+YZjD74hhsJr4ks3RD/yKulavXCQ==",
-      "signed_at": "2026-09-27T16:35:05.306Z"
+      "signed_at": "2026-09-27T17:35:11.860Z"
     },
     {
       "name": "api-security",
@@ -2035,7 +2035,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "y6LfKfsHtpPT+UBrfkXVR4xO139xvzrWOGTdyeEAna1kecWDJIqKKMdSpHqR4T7KG2HCAmgLCV2cmf3B3jnkAg==",
-      "signed_at": "2026-09-27T16:35:05.307Z",
+      "signed_at": "2026-09-27T17:35:11.861Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2131,7 +2131,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "f7b0+D4TJwd9c9ISGMFquvePueywoO92QZ172etyayBcDwYVTIiGYII67+NyaLl2+u0QG49d4QY41UPbRflrDw==",
-      "signed_at": "2026-09-27T16:35:05.307Z"
+      "signed_at": "2026-09-27T17:35:11.861Z"
     },
     {
       "name": "container-runtime-security",
@@ -2203,7 +2203,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "mN0q+CDc2WyUjgOzFwUBZBo3SbaOAvWn4CVBjLAYfWYDxm5em+vil0a5dlUWLXxviDNkeQpG0kaAv9dstqPWDg==",
-      "signed_at": "2026-09-27T16:35:05.308Z",
+      "signed_at": "2026-09-27T17:35:11.862Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2284,7 +2284,7 @@
         "MITRE ATLAS release 2026.06 (June 2026) added AML.T0113 (Steal Web Session Cookie), AML.T0091.001 (Use Alternate Authentication Material: Web Session Cookie) and AML.T0114 (AI Service Web Interface) to release 2026.05 and removed no technique ids. Earlier releases shipped the AML.T0010 sub-technique expansion and the agentic-AI techniques this forecast tracked (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"). Forward watch: subsequent monthly ATLAS releases, for updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "+DWL+I6VipjzZpvjZptUNk7jrCYhOBQqFy1ejThc4Gdr2BJ5vWYuRWclUUd4RhC58iv4S3NAgatuZOcXTOkRCg==",
-      "signed_at": "2026-09-27T16:35:05.308Z"
+      "signed_at": "2026-09-27T17:35:11.862Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2359,7 +2359,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "GXEqUic3Dg65QODe/2+AA5PJ2gkRLf39/AbFaZDt19GzknfhHlBxQf7LrpDX2S87JKPHzHPShRAFRxJSW90LAA==",
-      "signed_at": "2026-09-27T16:35:05.309Z"
+      "signed_at": "2026-09-27T17:35:11.863Z"
     },
     {
       "name": "ransomware-response",
@@ -2439,7 +2439,7 @@
       ],
       "last_threat_review": "2026-09-18",
       "signature": "ULB2eBGPwh5vgOTK9m9i7Do25p48npVDpyDqjRYOfUUHoYvXkG+XxF0DdJLrs27ngQ2TyETn6X9xKp4310RGBA==",
-      "signed_at": "2026-09-27T16:35:05.309Z"
+      "signed_at": "2026-09-27T17:35:11.863Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2507,7 +2507,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-09-27T16:35:05.310Z"
+      "signed_at": "2026-09-27T17:35:11.864Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2582,7 +2582,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "rlHzyruu9OhkcVrYfHnMJvQf9z3rnDh5VbDQr4qCmqFXTzPqyQz9u1GvKdNiElSNXv3Qv3afvUFsvcHxOxX4DQ==",
-      "signed_at": "2026-09-27T16:35:05.310Z"
+      "signed_at": "2026-09-27T17:35:11.864Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2662,7 +2662,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "jIHvISo1VRnvLRMktdJtEIpb/jKEu5yk23WrzoZCIdhtzGdcXL10vVfycxVM6U/tHg+u/5ju/x8wreQRnYHQBQ==",
-      "signed_at": "2026-09-27T16:35:05.310Z",
+      "signed_at": "2026-09-27T17:35:11.864Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2756,7 +2756,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "gbYSLSe+VfZy3fwKkKIIDa4ipF7lbcKTWMyEAmvdGoO4TgQKWZf5/1mAxOSj0kqkXc16ai09NsSc70NOP05RBA==",
-      "signed_at": "2026-09-27T16:35:05.311Z",
+      "signed_at": "2026-09-27T17:35:11.865Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2828,7 +2828,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-09-27T16:35:05.311Z"
+      "signed_at": "2026-09-27T17:35:11.865Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2887,7 +2887,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-09-27T16:35:05.311Z"
+      "signed_at": "2026-09-27T17:35:11.865Z"
     },
     {
       "name": "network-trust",
@@ -2943,7 +2943,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-09-27T16:35:05.311Z"
+      "signed_at": "2026-09-27T17:35:11.866Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2998,7 +2998,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "T7sFREX7P2QYrau+eTNXKkrU2aJ91dsX6GQWVJeexJ9SqbyFHtAnIKo4r6F6VdELADyVjaRXKk/fLuyUaCkGBA==",
-      "signed_at": "2026-09-27T16:35:05.312Z"
+      "signed_at": "2026-09-27T17:35:11.866Z"
     },
     {
       "name": "self-update-integrity",
@@ -3052,7 +3052,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "OKVmNgVoGGDS8kwezWrtFk62xgYkU3B7lhGRd7xO7wfSQPbETk+aeLmkpoS8sTryzrAg7JYhJ0qDofbSQpOTCg==",
-      "signed_at": "2026-09-27T16:35:05.312Z"
+      "signed_at": "2026-09-27T17:35:11.866Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3110,7 +3110,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "MWDxwIfhUvGAet5F1LBJnBApTBHafuW+NwysdaSYh8DmPM70bcg6v7f7qwv+zADXYc1LHdF4FoqiAcFy8TA7DA==",
-      "signed_at": "2026-09-27T16:35:05.312Z"
+      "signed_at": "2026-09-27T17:35:11.866Z"
     },
     {
       "name": "decompression-dos",
@@ -3168,7 +3168,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "iDsEYQo/OWYUI8TbBNsS9A60Kt5XEcZ1WYKg52wuSAzgctn4W68dgMeaoNbPXq2Bon1amFKIH5uxUtU8q7I/Dw==",
-      "signed_at": "2026-09-27T16:35:05.312Z"
+      "signed_at": "2026-09-27T17:35:11.867Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3223,7 +3223,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "1Qn1LUzL2qCvG+jEaif7uMVL/cDwyMVueZAhu5uSroQzfw1V5X2vm/t69fExGKoLnVdkfta71aZWI4Gz0tfiDQ==",
-      "signed_at": "2026-09-27T16:35:05.313Z"
+      "signed_at": "2026-09-27T17:35:11.867Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3278,11 +3278,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "UIzZfFwZP/7Gg5IdwQQTv6oDZyzjID8lXWYL1SgiSu4JRPJYzt/vqQO1ztfEaaRdbZBi0Vao3td2aFixnhw6AQ==",
-      "signed_at": "2026-09-27T16:35:05.313Z"
+      "signed_at": "2026-09-27T17:35:11.867Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "rFXSxSsyTNpJw4x4SsA/yENMTTVIbBWBw1/THqHhefhDtVAraL94hjPcqRjxFeJOvsijVJr14B4awZZEXykTAw=="
+    "signature_base64": "jSIOftIYe3BGoUqdPKaIZPeoDgfQ9nkgf8g33QuE/LWHo5sLj1ZW5q8I2tlnIU4tG6pyNoueWREEv6quHPrZBQ=="
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.21.6",
-  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1757 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+  "version": "0.21.7",
+  "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1758 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
     "ai-skills",

package/sbom.cdx.json

@@ -1,7 +1,7 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:3d5cbc1c-9e4f-4163-9c5f-0ad878fcf43d",
+  "serialNumber": "urn:uuid:48905b3c-7f50-4276-8f14-7777d62515c9",
   "version": 1,
   "metadata": {
     "timestamp": "2026-09-27T00:00:00.000Z",
@@ -9,15 +9,15 @@
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.21.6"
+        "version": "0.21.7"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.21.6",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.21.7",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.21.6",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1757 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.21.7",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1758 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.21.6",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.21.7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "af6dadce7d07299bd37d345871500e5490579d0fa194973821338120f4114b3d"
+          "content": "d76781ac5d69b20a9ecd6023fe4ab53715355bb40652266c5bc571e78b1a3d47"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.21.6"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.21.7"
         },
         {
           "type": "vcs",
@@ -124,11 +124,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "81c417a36db54abdb55947631447c9a0b7a6161cd07a0dac6392bcea3ebed4c9"
+          "content": "ebb77be221425db48b97b903af52cb57716bb26eb880ef8af063ab12654dcbd7"
         },
         {
           "alg": "SHA3-512",
-          "content": "c6131484d1699f4322566ba5374aec99720f94c0aa2ff0a27776633762be07b57e6eafed316ac6af340e63175826da3606b86069920722ea7e97feed3e837b11"
+          "content": "f5d35a7731d8a0b3b803ad4f4058eea560223537d87f9f53b64863274d5907273d77e28e7d2842796484d3769c5506543ac4e68c48b6875d38e4ef2b1b4d6713"
         }
       ]
     },
@@ -319,11 +319,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1c8e3ee0e5e2c0c81bdc753b77caae46d45fd668d676e0a17febc5e50217993f"
+          "content": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3"
         },
         {
           "alg": "SHA3-512",
-          "content": "d3e2871829a1da2d20d69f0534525d2e6132fc93e703536b1f566e13894ee3ddb9b4e73f1b86cef85a8bd64c9fa96880576d9a73a1d355e04fc596529edbc529"
+          "content": "03c6ded8cd44125e3a9af2e3d2148f219f6deae56fb8700dd28984af431d39c584dc2eddbb56d0c2743c2aa4f14f433099322f8fe7b7c14331997e97b27e6962"
         }
       ]
     },
@@ -334,11 +334,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5c568853f271d879d23d756d425155c2e8018c3cfde6ce5e9d3c709cefb2f0b1"
+          "content": "d4632abe8bda7993fcdefbb586e1ba7139c55e22a871b2bb167703fb9c00392c"
         },
         {
           "alg": "SHA3-512",
-          "content": "f46af363a471560d93d98bcafb0c4e3ea9d41fc85235c8feb76b80a6148e7b6fefee26778547b6ec74016cefcc00a0856c1babeb038fcb5276ea00405b1aa146"
+          "content": "bc77c4dbcc70f48f45a0c1f5d7078fef37bbc97c7329a45edf81aa82e04df5985b9f3e72603a1291dfcc93ed4464272b9701c8ce2c6d15d4014e8a50d1ffb59a"
         }
       ]
     },
@@ -349,11 +349,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e278adafce665dfe8475c05f4c6e9051e70a3100b2ce340e671a27547bcc0582"
+          "content": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c"
         },
         {
           "alg": "SHA3-512",
-          "content": "b10b56fa1fc384f91e54869869f114e571c4b33bdbe934c6210a2f8a4af777f7e10a8efa14558ad1dd6987addb15edd869410367e7ee74bb51ba87296d2af023"
+          "content": "816fc988b4375206b30f6efaff8e64fcef3cf622fca6c2b25634c33bef72d5b5bea5b9d220b070da3aeb9185780ec961336d3ad184f1c04930230c87920689a7"
         }
       ]
     },
@@ -409,11 +409,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f6857c6dae6f6a863d80f05ac0c056be2290d91d5b0371e6be5e66525d9e78f0"
+          "content": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089"
         },
         {
           "alg": "SHA3-512",
-          "content": "7c87084d99bb1f285d62c56213f08702e4007e158217ce66e9cd7f3766fb780d2e3d592b2f296b02f66a35b947be08154064a74b958a54033ba424e82ea8592d"
+          "content": "3979357a719b0b63b034fa2dc658f61795c125ecc776c7b9f9e2150f1ed0339fa73c0ce88edefc11169db90ec0458b378e97c61b9dcb18e87a238634b2e18824"
         }
       ]
     },
@@ -949,11 +949,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "21d9bb3092858a41817cf1b7284c9c6e3bf26aedb7aaaf18011bdbb6ba618ff4"
+          "content": "fc805929c375a3e4dfafaa5fdde9a54fd203ac3c44c1b02ae76e4aa9f7e82d62"
         },
         {
           "alg": "SHA3-512",
-          "content": "86e3d3e2c06bc1bce6dbddd4ace242350362fe5baddea04b1f346d26726cd8fcf1d2f390c5b1f672f9a68a98b1b5168cc11b6277a7a53ba252955e94c63ee895"
+          "content": "0ae1b53f76fb188e99429cec413ec2177308b90f9c9de07abc2298929ad93397cb1023024e660abef86880b62f9141976d5bf5ef4caa6ad799d0e6a0edf394cd"
         }
       ]
     },
@@ -1954,11 +1954,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bba4a92806445f7adb97598feb6485976857b6258d09ab4edd3ba9ed2601688e"
+          "content": "1a53c846b758ff96c4214fd7d65ef8bdd9344f5c1daf6df2e0550a07611aa617"
         },
         {
           "alg": "SHA3-512",
-          "content": "5458590e7d58a2b2fe64ba211819d4057d775f98678023002e20847e8f19aa046d07776d810cfd807b4c55d59ae7d95adef5a8f34efcbbfb1d5a68d9a5f76d05"
+          "content": "48da78ec3667d9804d0b94431ef1eb9f289a926300c27cf2450f7bbb5a44004514fb43960d456771362269db3d837078268be7d9beb70d09c6eaa6cbd957d0c0"
         }
       ]
     },
@@ -2074,11 +2074,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f1890f2ab3fbdb3a9a51598a951f489c90e72489b20555ff85115267670eda01"
+          "content": "f2b1e00f69c3cdaf5757ab89311cb3e695d9fca51ebd93813fe33911d2ea2b99"
         },
         {
           "alg": "SHA3-512",
-          "content": "649060b879e4201872f06cfcfa1ac1ca53292f224d18f1cb7f2621a9de329b6b40bcc86fcc52584a8da7e14ef35bdd6e4c89deea73bb67ce2e0ed07f5e857732"
+          "content": "096c992936d48b38cd60d244cd2c9ed47f9afeedb66bebca0a086e80014f924498d21b4f8595b9b8579a8cd73d5d9d1c796e0b391c0192448a419d557a1d2db6"
         }
       ]
     },