Purpose
A structured catalog of all Common Weakness Enumeration (CWE) weaknesses Hunter Storm identified during The Storm Project. It is part of her MITRE Submissions Catalog. under her Security Research | Industry and Standards Body Contributions. The work is aligned to the Hunter Storm Records Management System (HSRMS), also known as the Weapon of Mass Documentation (WMD) framework.
Provenance
Hunter Storm did not proactively hunt these weaknesses. They surfaced organically during:
- operations
- incident investigations
- structured‑data forensics
- identity‑graph reconstruction
- semantic‑integrity analysis
- AI‑layer amplification review
Each entry reflects real‑world phenomena, not theoretical constructs, synthetic test cases, or the output of an AI or search engine.
Submission Status
All listed weaknesses have been submitted to MITRE. Additional submissions are pending due to the enormous backlog generated during The Storm Project. New entries will be added to this catalog as they are formalized, validated, and uploaded.
Scope
This catalog includes:
- Hunter‑specific CWE variants
- Newly discovered weakness classes
- Mixed‑encoding and semantic‑corruption patterns
- Identity‑graph downgrade vectors
- AI‑enabled HITL exploitation behaviors
Each entry follows a consistent structure within the WMD governance model.
Common Weakness Enumeration (CWE)
- CWE‑HS‑000001 — Unverified Modification of Structured Data Leading to Identity‑Graph Downgrade
- CWE‑HS‑000002 — StormBake: AI-Enabled HITL‑Driven Mixed‑Encoding Semantic Corruption and Unicode Sabotage
(More entries will be added as they are processed through HSRMS.)
Discover More from Hunter Storm
- About the Hunter Storm Federal Whistleblower Timeline
- Hunter Storm Official Site
- Hunter Storm Records Management System (HSRMS) Data Dictionary
- Navigating the Storm | Historical Cybersecurity Outage Lessons and Best Practices
- Post‑Quantum Cryptography (PQC) and Quantum Security Series (2025–Present)
- Publications
- Quantum Technology and Security Status 2025
- Research
- StormWatch | Lessons from the CISA ChatGPT Incident
- StormWatch | Public AI, Private Data: Why Uploading Sensitive Information Is a Systemic Failure — Not an AI Problem