@blamejs/exceptd-skills 0.21.6 → 0.21.8

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.21.8 — 2026-09-27
+
+1,998 zero-day lesson texts and 2 catalog fields no longer cite the curation input instead of a source, as in "Packet: ...", "Packet fields for CVE-...", "the packet's own ..." or a catalog field name such as `cisa_kev` or `live_patch_notes` quoted as evidence. Each text now states the fact directly, and names CISA's KEV entry or the vendor advisory where that is the source. The `pipeline-wording` class in the catalog gap audit falls from 2,159 texts to 159, and the predeploy budget gate now holds it at 159.
+
+## 0.21.7 — 2026-09-27
+
+The catalog holds 1,758 CVEs after one addition from CISA KEV: CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU driver on Android and other Snapdragon devices. It has no public exploit, and the fix needs a device restart. Google's Threat Analysis Group attributes its use as a zero-day to the commercial surveillance vendor Intellexa.
+
+Four Qualcomm entries now include their CVE id in the title, because CISA gives them the same name: the new CVE-2021-1905 and the existing CVE-2022-22071, CVE-2023-33063 and CVE-2025-27038.
+
+The framework gap for Australian ISM control ISM-0298 now also covers the check that an applied update carries the fix for a given vulnerability, such as an Android device whose security patch level is not one the vendor's bulletin lists the fix under. Its theater test asks for that evidence for one remediated CVE, and CVE-2021-1905 is the gap's first evidence entry.
+
 ## 0.21.6 — 2026-09-27
 
 The catalog holds 1,757 CVEs after three additions from CISA KEV: CVE-2021-22893, an authentication bypass in Pulse Connect Secure, CVE-2021-20022, an arbitrary file upload in SonicWall Email Security, and CVE-2021-38645, a local privilege escalation in Microsoft's Open Management Infrastructure. None has a public exploit. The Pulse Connect Secure and SonicWall flaws carry CISA's ransomware designation and need a restart before the fix takes effect.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T16:35:06.498Z",
+  "generated_at": "2026-09-27T22:56:11.649Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "bba4a92806445f7adb97598feb6485976857b6258d09ab4edd3ba9ed2601688e",
+    "manifest.json": "43a28aa0bf1a3d6cf1cab2b61d62f06fc24a81edead71e6bb9787dec5fb1fee4",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "1c8e3ee0e5e2c0c81bdc753b77caae46d45fd668d676e0a17febc5e50217993f",
-    "data/cve-catalog.json": "5c568853f271d879d23d756d425155c2e8018c3cfde6ce5e9d3c709cefb2f0b1",
-    "data/cwe-catalog.json": "e278adafce665dfe8475c05f4c6e9051e70a3100b2ce340e671a27547bcc0582",
+    "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
+    "data/cve-catalog.json": "3a023a3d5c29b02cd23782936db8a2e863837f95dd715e0d3f4579cf088f298d",
+    "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
-    "data/framework-control-gaps.json": "f6857c6dae6f6a863d80f05ac0c056be2290d91d5b0371e6be5e66525d9e78f0",
+    "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "21d9bb3092858a41817cf1b7284c9c6e3bf26aedb7aaaf18011bdbb6ba618ff4",
+    "data/zeroday-lessons.json": "4f472ef8b15d0634dc37f1c126429d601f3b537c875dbf1052b1623f54a6ce9f",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1744,
+    "chains_cve_entries": 1745,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -11,7 +11,7 @@
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1757
+      "entry_count": 1758
     },
     {
       "date": "2026-09-27",
@@ -19,7 +19,7 @@
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1757
+      "entry_count": 1758
     },
     {
       "date": "2026-09-22",

package/data/_indexes/catalog-summaries.json

@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1757,
+      "entry_count": 1758,
       "sample_keys": [
+        "CVE-2021-1905",
         "CVE-2021-20022",
         "CVE-2021-22893",
         "CVE-2021-38645",
-        "CVE-2021-20021",
-        "CVE-2021-20016"
+        "CVE-2021-20021"
       ]
     },
     "cwe-catalog.json": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1757,
+      "entry_count": 1758,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 36405496 bytes
-sha256: 1f21de50a9f778f00e23953a3541bde6f506a7ef702783c5b5a77400fac56985
+size: 36422355 bytes
+sha256: fa9a606edd2ae06b45c401d62fb46cd219bd81d3b46d5d62a107be315185839b

package/data/attack-techniques.json

@@ -890,6 +890,7 @@
       "CVE-2021-1048",
       "CVE-2021-1647",
       "CVE-2021-1782",
+      "CVE-2021-1905",
       "CVE-2021-21551",
       "CVE-2021-22555",
       "CVE-2021-22600",

package/data/cve-catalog.json

@@ -93,6 +93,115 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2021-1905": {
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)",
+    "cvss_score": 7.8,
+    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-416"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2022-05-03",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables",
+    "epss_score": 0.01543,
+    "epss_percentile": 0.73939,
+    "epss_date": "2026-09-26",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-1905",
+    "vendor_advisories": [
+      {
+        "vendor": "Qualcomm",
+        "advisory_id": "may-2021-bulletin",
+        "url": "https://web.archive.org/web/20220324012231/https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin",
+        "severity": "high",
+        "published_date": "2021-05-03"
+      },
+      {
+        "vendor": "Google",
+        "advisory_id": "2021-05-01",
+        "url": "https://source.android.com/docs/security/bulletin/2021-05-01",
+        "severity": "high",
+        "published_date": "2021-05-03"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-1905",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.",
+    "type": "use-after-free-gpu-driver-lpe",
+    "blast_radius": 20,
+    "poc_available": false,
+    "poc_description": "No hosted working exploit for this CVE was found. Google Project Zero published a root-cause analysis of CVE-2021-1905 whose Proof-of-concept and Exploit sample fields both read N/A and which states the analysts did not have access to the exploit sample. The Exploit-DB index, the Metasploit framework repository and the ProjectDiscovery nuclei templates repository hold no entry for this CVE. The only GitHub repository that names it, https://github.com/TAKIANFIF/CVE-2021-1905-CVE-2021-1906-CVE-2021-28663-CVE-2021-28664, is empty and holds no code. What is documented is analysis and vendor and platform advisories, not obtainable exploit code.",
+    "iocs": {
+      "behavioral": [
+        "Any local process, including an untrusted app or a browser process, repeatedly opening the Qualcomm graphics device and forking children after opening the KGSL file descriptor so multiple processes share one GPU mapping, consistent with attempts to trigger the use-after-free",
+        "A local process racing two mappings of the same GPU memory at once, then reusing the freed GPU mapping structure, followed by activity that runs with elevated privileges on the device",
+        "Any local process, including an installed app or a browser process, gaining kernel-level privileges shortly after heavy or unusual use of the GPU memory-mapping interface"
+      ],
+      "network": [],
+      "host": [
+        "An Android device on an affected Qualcomm chipset whose security patch level is earlier than 2021-05-05, which includes a device that reports 2021-05-01",
+        "A Qualcomm Snapdragon chipset from the affected list (spanning Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables) reported in the Qualcomm May 2021 bulletin as affected by CVE-2021-1905",
+        "Local access to the Qualcomm Adreno GPU kernel driver (the KGSL interface) by an untrusted process, which is the precondition for triggering the flaw"
+      ],
+      "_ioc_source_note": "The use-after-free mechanism, that a GPU shared mapping with multiple virtual memory areas and a race in the driver's unmapped-area path leave a freed mapping structure reachable, was read from Google Project Zero's root-cause analysis at https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html. That analysis gives the Android 2021-05-01 security patch level as the first patched version, but the Android Security Bulletin for May 2021, archived at https://web.archive.org/web/20260917102124/https://source.android.com/docs/security/bulletin/2021-05-01, lists CVE-2021-1905 under the 2021-05-05 security patch level, so the patch-level indicator follows the bulletin. The limited, targeted exploitation statement was read from the same bulletin. The affected chipset list, the High rating and the codeaurora patch reference were read from the Qualcomm May 2021 bulletin as archived at https://web.archive.org/web/20220324012231/https://www.qualcomm.com/company/product-security/bulletins/may-2021-bulletin. All host and behavioral items are general hunting heuristics derived from the mechanism, not artifacts read from an exploit sample; the flaw requires local code execution and has no network indicators. Google TAG's Buying Spying report at https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors_-_TAG_report.pdf attributes 0-day use of this CVE against Android to the tooling of the commercial surveillance vendor Intellexa. No actor infrastructure, file hash or C2 address is listed, because that report names this CVE only in its appendix table and ties no infrastructure, hash or address to it, and no other source consulted ties any of them to this exploit."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Google Project Zero's root-cause analysis lists the reporter as N/A and did not have the exploit sample; no source consulted names a party that found or reported the flaw, and no AI tooling is claimed.",
+    "ai_discovery_source": "unknown",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-1905 (CWE-416, CVSS 7.8) + CISA KEV (added 2021-11-03) + Qualcomm May 2021 security bulletin; no source names the finder, and the Project Zero analysis records the reporter as N/A.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-1905 to the KEV catalog on 2021-11-03 with a 2022-05-03 due date and records known ransomware use as Unknown; its forensicTriage flag is No and the required action is to apply updates per vendor instructions. The Android Security Bulletin for May 2021 states there are indications that CVE-2021-1905, together with CVE-2021-1906, CVE-2021-28663 and CVE-2021-28664, may be under limited, targeted exploitation. Google TAG's February 2024 report Buying Spying: Insights into Commercial Surveillance Vendors lists CVE-2021-1905 (Qualcomm Adreno GPU, exploited against Android) in its appendix table of commercial surveillance vendors' products and known 0-day exploits, under the vendor Intellexa, which the table lists with the alias Cytrox and with products including the ALIEN stager and the PREDATOR spyware. The report names CVE-2021-1905 only in that table and gives no campaign dates, targets or exploit chain for it.",
+    "attack_refs": [
+      "T1068"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SC-39": "SC-39 requires the system to maintain a separate execution domain for each executing system process. In the Qualcomm GPU design, several processes can share one GPU address space, such as a child forked after the KGSL file descriptor is opened, so their mappings share one kgsl_mem_entry on which the driver holds no lock, and CVE-2021-1905 is triggered by a state error on that shared structure followed by a race between two such processes mapping it at the same time. An SC-39 assessment of separation between operating-system processes does not test per-process state that a device driver shares across processes by design.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within the scope of Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and, in cases where a patch is not available, requires additional measures with the residual risk accepted, without naming those measures. For CVE-2021-1905 the fix is in the Android 2021-05-05 security patch level, and a handset receives it only when its maker ships that level, so an in-scope entity can hold affected devices for which no patch is available; 6.6.1 does not name gating access on the 2021-05-05 level as an additional measure for that period.",
+      "UK-CAF-B4": "CAF outcome B4.d at Achieved expects announced vulnerabilities for all software packages, network and information systems supporting an essential function to be tracked, prioritized and mitigated, for example by patching, promptly. The Partially achieved level requires prompt mitigation only for externally exposed vulnerabilities and allows some vulnerabilities that are not externally exposed to have temporary mitigations for an extended period. CVE-2021-1905 is a local flaw reached by any local code execution, including an earlier exploit in a chain, so an organization assessed at Partially achieved can keep it under an extended temporary mitigation, such as restricting untrusted app installation, which does not stop a chain that starts with a remote exploit, although the Android Security Bulletin for May 2021 reported indications of limited, targeted exploitation. At Achieved, \"promptly\" is not defined for a flaw whose fix a handset can install only after its maker ships the 2021-05-05 security patch level.",
+      "AU-ISM-0298": "ISM-0298 requires a centralized and managed approach that maintains the integrity of patches or updates and confirms that they have been applied successfully, for applications, operating systems, drivers and firmware. The Android Security Bulletin for May 2021 splits the month into a 2021-05-01 and a 2021-05-05 security patch level and lists this Qualcomm GPU driver fix only under 2021-05-05, so a confirmation that a device's May 2021 update applied successfully passes a device that reports 2021-05-01 and still carries CVE-2021-1905. ISM-0298 checks that an update was applied, not that the applied update contains the fix for a given vulnerability.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated, and appropriate measures are taken, and it sets no timescale for those measures. For CVE-2021-1905 the Android Security Bulletin for May 2021 reported indications of limited, targeted exploitation, and a handset can install the fix only after its maker ships the 2021-05-05 security patch level, so A.8.8 leaves how long affected devices may stay exposed to a timescale each organization sets for itself."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No live patch exists; the fix is delivered as an operating-system security update that requires a device reboot to apply. Qualcomm published the fix in its May 2021 bulletin with a patch referenced on codeaurora, and on Android it is carried by the 2021-05-05 security patch level, not the 2021-05-01 level, but it reaches a given device only when its maker ships the corresponding update, so patch availability from Qualcomm does not mean every affected device can yet install it.",
+    "affected": "Multiple Qualcomm Snapdragon chipsets using the Adreno GPU kernel driver, across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables. An untrusted local process on the device can trigger a use-after-free in the GPU memory-mapping path, which the CVSS vectors from NVD and Qualcomm rate as high impact to confidentiality, integrity and availability.",
+    "affected_versions": [
+      "Qualcomm chipsets listed in the May 2021 security bulletin as affected by CVE-2021-1905, spanning the Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice and Music and Wearables families",
+      "On Android, devices below the 2021-05-05 security patch level are affected, including devices that report 2021-05-01; the Android Security Bulletin for May 2021 lists this fix only in the 2021-05-05 patch level",
+      "On Android devices, including wearables and automotive units that run Android and report an Android security patch level, a device can install the fix only after its maker ships an update carrying the 2021-05-05 patch level; on devices that report no Android security patch level, the fix is the maker's update that integrates Qualcomm's May 2021 fix for CVE-2021-1905 (Android bug A-178809945, Qualcomm QC-CR#2826864). Project Zero and Qualcomm's bulletin give the fix commits in Qualcomm's msm-4.9 kernel tree: d236d315145f8250523ce9e14897d62e5d6639fc, the patch Qualcomm's bulletin lists, and ec3c8cf016991818ca286c4fd92255393c211405, which Project Zero also ties to this flaw; those two ids are the reference only for kernels built from msm-4.9"
+    ],
+    "vendor_update_paths": [
+      "On Android devices, including wearables and automotive units that run Android and report an Android security patch level, install the maker's update that brings the device to the 2021-05-05 security patch level or later, which requires a device reboot; a device that reports 2021-05-01 does not carry this fix. The underlying Qualcomm fix is published in the May 2021 security bulletin with a patch referenced on codeaurora.",
+      "On devices built on the affected chipsets that report no Android security patch level, install the device maker's update that integrates Qualcomm's May 2021 fix for CVE-2021-1905, and check the chipset against the affected list in Qualcomm's May 2021 security bulletin. Where such a device runs a Linux kernel with Qualcomm's KGSL graphics driver, confirm with the maker that the update integrates Qualcomm's fix for CVE-2021-1905 (Android bug A-178809945, Qualcomm QC-CR#2826864), including the locking change Project Zero describes. For a kernel built from Qualcomm's msm-4.9 tree, the reference is the two commits Project Zero considers relevant: d236d315145f8250523ce9e14897d62e5d6639fc, the one Qualcomm's bulletin lists, and ec3c8cf016991818ca286c4fd92255393c211405, the locking change the bulletin does not list. Those ids are given for the msm-4.9 tree, so do not treat their absence from a kernel built from another Qualcomm tree as a missing fix.",
+      "For a managed fleet, gate access to organizational data on the device meeting the 2021-05-05 security patch level and quarantine devices that cannot reach it, since the platform fix depends on each maker shipping an update.",
+      "Where a device maker has not yet shipped the fix, restrict installation of untrusted applications, since the flaw requires local code execution to reach the GPU driver. That restriction does not stop an exploit chain that gains code execution through the browser, so for users who fit a spyware targeting profile, also replace or retire devices that cannot reach the 2021-05-05 security patch level, or keep them away from organizational data."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 20,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 55,
+    "rwep_notes": "RWEP 55. cisa_kev +25, active_exploitation +20, blast_radius +20, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
   "CVE-2021-20022": {
     "name": "SonicWall Email Security Unrestricted Upload of File Vulnerability",
     "cvss_score": 7.2,
@@ -16716,7 +16825,7 @@
     "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2019-2725 (CWE-74, CVSS 9.8, affected 10.3.6.0.0 and 12.1.3.0.0) and the CISA KEV record (added 2022-01-10, due 2022-07-10, ransomware Known). Exploit availability confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates. Oracle's alert-cve-2019-2725 page returned HTTP 403 and could not be quoted, so vendor wording, patch identifiers and any acknowledgement are absent by omission rather than by judgement.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-07-10 due date and records the ransomware association as Known. Oracle handled the fix as a standalone Security Alert (alert-cve-2019-2725) rather than folding it into a quarterly Critical Patch Update, and the packet's own vendor-advisory reference list for this CVE also carries the July 2019 and January 2020 Critical Patch Update pages - an out-of-band alert is the vendor's own signal that the flaw was already being used when the fix shipped. The Oracle alert page returned HTTP 403 to every fetch in this pass, so no vendor wording and no credit line is quoted here. No named campaign, actor or ransomware family is confirmed from a source retrieved for this entry: the ransomware association is the KEV record's own field, not an attribution report read here.",
+    "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-07-10 due date and records the ransomware association as Known. Oracle handled the fix as a standalone Security Alert (alert-cve-2019-2725) rather than folding it into a quarterly Critical Patch Update, and Oracle's vendor advisories for this CVE also include the July 2019 and January 2020 Critical Patch Update pages. An out-of-band alert is the vendor's own signal that the flaw was already being used when the fix shipped. The Oracle alert page returned HTTP 403 to every fetch made for this entry, so no vendor wording and no credit line is quoted here. No named campaign, actor or ransomware family is confirmed from a source retrieved for this entry: the ransomware association is the KEV record's own field, not an attribution report read here.",
     "attack_refs": [
       "T1190",
       "T1059",
@@ -23229,7 +23338,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Apple credits 'an anonymous researcher' in HT212807. No AI tooling is named, and the report predates AI-assisted vulnerability discovery becoming an operational reality. The researcher's identity is withheld by Apple, not unknown to it, which is why the source is recorded as human_researcher rather than unknown.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2021-30858 (CWE-416, CVSS 8.8), the CISA KEV record (added 2021-11-03, due 2021-11-17) including its note about non-Apple WebKit embedders, and Apple support document HT212807 for iOS 14.8 / iPadOS 14.8 (13 September 2021), which supplies the impact wording and the 'an anonymous researcher' credit. The packet's own references array for this CVE is empty; HT212807 was retrieved for this pass. Absence of a public exploit module confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates.",
+    "discovery_attribution_note": "This entry draws on NVD CVE-2021-30858 (CWE-416, CVSS 8.8), the CISA KEV record (added 2021-11-03, due 2021-11-17) including its note about non-Apple WebKit embedders, and Apple support document HT212807 for iOS 14.8 / iPadOS 14.8 (13 September 2021), which supplies the impact wording and the 'an anonymous researcher' credit. HT212807 was retrieved for this entry. The absence of a public exploit module was confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple support document HT212807, covering iOS 14.8 and iPadOS 14.8 released 13 September 2021, states for this CVE: 'Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.' The credit is to 'an anonymous researcher' - Apple names no reporting organisation. CISA added the CVE to KEV on 2021-11-03 with a 2021-11-17 due date and records the ransomware association as Unknown. Apple names no campaign and no actor, and no named campaign is confirmed from a source retrieved for this entry. The one hard adjacency worth carrying: the same 14.8 update also fixed CVE-2021-30860, so an unpatched device carried two flaws Apple describes as possibly actively exploited.",
     "attack_refs": [
@@ -97685,7 +97794,7 @@
     "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2023-33063": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2023-33063)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -97776,7 +97885,7 @@
     "rwep_notes": "RWEP 57. cisa_kev +25, active_exploitation +20, blast_radius +22, patch_available -15, reboot_required +5. Σ factors === rwep_score."
   },
   "CVE-2022-22071": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2022-22071)",
     "cvss_score": 7.8,
     "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
     "cwe_refs": [
@@ -167136,7 +167245,7 @@
     "last_verified": "2026-08-22"
   },
   "CVE-2025-27038": {
-    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability",
+    "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2025-27038)",
     "type": "memory-corruption",
     "cvss_score": 8.8,
     "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",

package/data/cwe-catalog.json

@@ -1877,6 +1877,7 @@
       "CVE-2020-9715",
       "CVE-2021-0920",
       "CVE-2021-1048",
+      "CVE-2021-1905",
       "CVE-2021-21193",
       "CVE-2021-21206",
       "CVE-2021-22893",

package/data/framework-control-gaps.json

@@ -3886,6 +3886,7 @@
       "CVE-2021-1870",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
@@ -5270,6 +5271,7 @@
       "CVE-2021-1789",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-21148",
@@ -6245,6 +6247,7 @@
       "CVE-2020-0986",
       "CVE-2020-17087",
       "CVE-2021-1782",
+      "CVE-2021-1905",
       "CVE-2021-22600",
       "CVE-2021-25370",
       "CVE-2021-28664",
@@ -12810,6 +12813,7 @@
       "CVE-2021-1789",
       "CVE-2021-1870",
       "CVE-2021-1879",
+      "CVE-2021-1905",
       "CVE-2021-20016",
       "CVE-2021-20022",
       "CVE-2021-20028",
@@ -14870,12 +14874,15 @@
     "misses": [
       "Software that updates itself (browsers, agents, desktop applications, device firmware) fetches and applies updates outside any centralised system, so the integrity check the control requires never runs on those updates",
       "Integrity is usually taken to mean the vendor's signature verified, which does not detect a signed update from a compromised build system or a rollback to an older signed build",
-      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published"
+      "Confirmation that an update applied records the installed version, not that the binary running matches what the vendor published",
+      "Confirmation that an update applied does not show that it carries the fix for a given vulnerability: an Android device can apply its monthly update successfully and report a security patch level that the vendor's bulletin does not list the fix under"
     ],
-    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact.",
+    "real_requirement": "Update integrity evidence must cover self-updating software as well as centrally patched software: signature verification before apply, pinning of the update signing key out of band, rejection of rollbacks to older signed builds, and a post-install check that the running binary matches the published artifact. For each vulnerability being remediated, the evidence must also show that the installed build or security patch level is one the vendor lists the fix under, not only that an update applied.",
     "status": "open",
     "opened_date": "2026-09-22",
-    "evidence_cves": [],
+    "evidence_cves": [
+      "CVE-2021-1905"
+    ],
     "atlas_refs": [],
     "attack_refs": [
       "T1195.002",
@@ -14883,16 +14890,15 @@
     ],
     "theater_test": {
       "claim": "Our patches and updates keep their integrity and are confirmed applied, which satisfies ISM-0298.",
-      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Theater verdict if the evidence covers only centrally deployed patches, or if any self-updating product has no documented integrity check.",
+      "test": "List the software on a sample host that updates itself outside the central patching system. For each, confirm the update client verifies a signature before applying, rejects a rollback to an older signed build, and that someone can show the installed binary matches the vendor's published artifact. Then pick one remediated CVE and confirm the record shows an installed build or security patch level that the vendor lists its fix under. Theater verdict if the evidence covers only centrally deployed patches, if any self-updating product has no documented integrity check, or if the remediated CVE is recorded as fixed on the strength of an applied update alone.",
       "evidence_required": [
         "inventory of self-updating software on a sampled host",
         "per-product record of signature verification and rollback protection",
-        "post-install artifact comparison for one sampled update"
+        "post-install artifact comparison for one sampled update",
+        "for one remediated CVE, the installed build or security patch level compared with the level the vendor lists its fix under"
       ],
       "verdict_when_failed": "compliance-theater"
-    },
-    "forward_looking": true,
-    "forward_looking_reason": "No CVE in the catalog anchors this gap yet; it records the control class without binding it to a single incident."
+    }
   },
   "AU-ISM-1240": {
     "framework": "Australian Government Information Security Manual (ISM)",