Merge pull request #6 from p80n-sec/sort-findings-newest-first

Sort the findings tables newest disclosure first

Author: p80n-sec

README.md

@@ -10,11 +10,11 @@ Browse the full inventory, including per-finding detail pages and talks:
 <!-- BEGIN:published -->
 | ID | Date | Project | CVSS | Links |
 |---|---|---|---|---|
+| [CVE-2026-27959](https://nvd.nist.gov/vuln/detail/CVE-2026-27959) | 2026-02-26 | Koa | 7.5 | [Writeup](https://www.endorlabs.com/learn/cve-2026-27959-koa) |
 | [CVE-2025-63662](https://nvd.nist.gov/vuln/detail/CVE-2025-63662) | 2025-12-22 | GT Edge AI Platform | 7.5 | [Writeup](https://gist.github.com/p80n-sec/48ce34c929e8b946f0ad25f76e7b8cef) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |
 | [CVE-2025-63663](https://nvd.nist.gov/vuln/detail/CVE-2025-63663) | 2025-12-22 | GT Edge AI Platform | 7.5 | [Writeup](https://gist.github.com/p80n-sec/f3ca933480157cb4e18c387d92f4d0c2) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |
 | [CVE-2025-63664](https://nvd.nist.gov/vuln/detail/CVE-2025-63664) | 2025-12-22 | GT Edge AI Platform | 7.5 | [Writeup](https://gist.github.com/p80n-sec/0a0a71a2190d5e6f8083bf6069e7b5f2) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |
 | [CVE-2025-63665](https://nvd.nist.gov/vuln/detail/CVE-2025-63665) | 2025-12-19 | GT Edge AI Platform | 9.8 | [Writeup](https://gist.github.com/p80n-sec/e5eefcef155e9dd14aaaaa49f9f94cd1) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |
-| [CVE-2026-27959](https://nvd.nist.gov/vuln/detail/CVE-2026-27959) | 2026-02-26 | Koa | 7.5 | [Writeup](https://www.endorlabs.com/learn/cve-2026-27959-koa) |
 <!-- END:published -->
 
 CVSS scores are CISA-ADP assessments where NVD analysis is still pending.

tools/research/records.py

@@ -274,6 +274,22 @@ def load_findings(root: Path) -> list[Finding]:
     return sorted(findings, key=lambda f: f.key)
 
 
+def published_newest_first(findings: list[Finding]) -> list[Finding]:
+    """Published findings, most recently disclosed first.
+
+    load_findings returns key order, which is the canonical order for detail
+    pages and duplicate detection but reads as arbitrary in a table: CVE ids
+    sort lexically, so a 2026 identifier assigned before disclosure can land
+    above a finding disclosed months later. Both tables want the reverse-
+    chronological order the talks and links lists already use.
+
+    The sort is stable, so same-day disclosures keep the key order they came
+    in with rather than shuffling between runs and churning the README.
+    """
+    published = [f for f in findings if f.status == "published"]
+    return sorted(published, key=lambda f: f.disclosed, reverse=True)
+
+
 def load_talks(root: Path) -> list[Talk]:
     talks = []
     for path in sorted((root / "talks").glob("*/talk.md")):

tools/research/render_html.py

@@ -15,7 +15,15 @@
 import markdown
 
 from .clock import days_remaining, effective_deadline
-from .records import Finding, Link, Profile, Talk, ValidationError, id_url
+from .records import (
+    Finding,
+    Link,
+    Profile,
+    Talk,
+    ValidationError,
+    id_url,
+    published_newest_first,
+)
 
 TEMPLATES = Path(__file__).parent / "templates"
 SOON_THRESHOLD_DAYS = 14
@@ -88,9 +96,7 @@ def _talks_cell(finding: Finding, talk_events: dict[str, str]) -> str:
 def _published_rows(findings: list[Finding], talk_events: dict[str, str] | None = None) -> str:
     events = talk_events or {}
     rows = []
-    for f in findings:
-        if f.status != "published":
-            continue
+    for f in published_newest_first(findings):
         rows.append(
             "<tr>"
             f'<td class="id"><a href="{_esc(f.key)}/">{_esc(f.id)}</a></td>'

tools/research/render_md.py

@@ -9,7 +9,7 @@
 import re
 
 from .clock import effective_deadline
-from .records import Finding, ValidationError, id_url
+from .records import Finding, ValidationError, id_url, published_newest_first
 
 MARKER_NAMES = ("published", "pending")
 
@@ -71,9 +71,7 @@ def _links_cell(finding: Finding, talk_events: dict[str, str]) -> str:
 def published_table(findings: list[Finding], talk_events: dict[str, str] | None = None) -> str:
     events = talk_events or {}
     rows = []
-    for finding in findings:
-        if finding.status != "published":
-            continue
+    for finding in published_newest_first(findings):
         rows.append(
             f"| [{_cell(finding.id)}]({_url(id_url(finding.id))}) "
             f"| {finding.disclosed:%Y-%m-%d} "

tools/tests/test_records.py

@@ -211,6 +211,33 @@ def test_load_findings_includes_duplicates_dir_and_sorts(tmp_path):
     assert [f.key for f in found] == ["CVE-2025-63662", "CVE-2025-63663", "EL-2026-014"]
 
 
+def test_published_newest_first_orders_by_disclosure_date(tmp_path):
+    write(tmp_path, "findings/CVE-2025-63662/finding.md", PUBLISHED)
+    write(tmp_path, "findings/CVE-2026-27959/finding.md", PUBLISHED
+          .replace("CVE-2025-63662", "CVE-2026-27959")
+          .replace("disclosed: 2025-12-22", "disclosed: 2026-02-26"))
+    ordered = records.published_newest_first(records.load_findings(tmp_path))
+    assert [f.key for f in ordered] == ["CVE-2026-27959", "CVE-2025-63662"]
+
+
+def test_published_newest_first_breaks_ties_on_key(tmp_path):
+    """Same-day disclosures keep load_findings' key order, so output is stable."""
+    write(tmp_path, "findings/CVE-2025-63664/finding.md", PUBLISHED.replace("63662", "63664"))
+    write(tmp_path, "findings/CVE-2025-63662/finding.md", PUBLISHED)
+    write(tmp_path, "findings/CVE-2025-63663/finding.md", PUBLISHED.replace("63662", "63663"))
+    ordered = records.published_newest_first(records.load_findings(tmp_path))
+    assert [f.key for f in ordered] == [
+        "CVE-2025-63662", "CVE-2025-63663", "CVE-2025-63664",
+    ]
+
+
+def test_published_newest_first_drops_unpublished_records(tmp_path):
+    write(tmp_path, "findings/CVE-2025-63662/finding.md", PUBLISHED)
+    write(tmp_path, "findings/EL-2026-001/finding.md", PENDING)
+    ordered = records.published_newest_first(records.load_findings(tmp_path))
+    assert [f.key for f in ordered] == ["CVE-2025-63662"]
+
+
 def test_duplicate_key_across_findings_and_duplicates_is_an_error(tmp_path):
     write(tmp_path, "findings/EL-2026-014/finding.md", PENDING.replace(
         "EL-2026-001", "EL-2026-014"))

tools/tests/test_render_html.py

@@ -29,6 +29,15 @@ def test_index_published_table_has_seven_columns(tmp_path):
         assert column in html
 
 
+def test_index_published_table_lists_newest_disclosure_first(tmp_path):
+    older = finding(key="CVE-2025-63662", id="CVE-2025-63662",
+                    disclosed=date(2025, 12, 22))
+    newer = finding(key="CVE-2026-27959", id="CVE-2026-27959",
+                    disclosed=date(2026, 2, 26))
+    html = render(tmp_path, findings=[older, newer])
+    assert html.index("CVE-2026-27959") < html.index("CVE-2025-63662")
+
+
 def test_index_pending_table_uses_endor_column_names(tmp_path):
     html = render(tmp_path)
     assert "Project / Repository" in html

tools/tests/test_render_md.py

@@ -137,6 +137,19 @@ def test_trailing_backslash_in_project_does_not_escape_the_delimiter():
     assert len(re.findall(r"(?<!\\)\|", row)) == 6
 
 
+def test_published_table_lists_newest_disclosure_first():
+    """load_findings hands over key order; the table must re-sort by date."""
+    older = finding(key="CVE-2025-63662", id="CVE-2025-63662",
+                    disclosed=date(2025, 12, 22))
+    newer = finding(key="CVE-2026-27959", id="CVE-2026-27959",
+                    disclosed=date(2026, 2, 26))
+    rows = render_md.published_table([older, newer]).splitlines()[2:]
+    assert [row.split("|")[1].strip() for row in rows] == [
+        "[CVE-2026-27959](https://nvd.nist.gov/vuln/detail/CVE-2026-27959)",
+        "[CVE-2025-63662](https://nvd.nist.gov/vuln/detail/CVE-2025-63662)",
+    ]
+
+
 def test_paren_in_url_does_not_truncate_the_link():
     table = render_md.published_table([finding(blog="https://e.com/a)b")])
     assert "[Writeup](https://e.com/a%29b)" in table