From 20a94d246bdbb13534a137276d2d1d44977486d0 Mon Sep 17 00:00:00 2001
From: "andre.bolinhas" <andre.bolinhas@articatech.com>
Date: Wed, 4 Nov 2026 01:02:08 +0000
Subject: [PATCH] Publish CVE channel (2026-11-04T01:02:01Z)

Validated against the engine's TestPublishedFeedDoesNotDuplicateACompiledRule guard.
Entries carrying an id: 2
---
 cve.json | 25 ++++---------------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/cve.json b/cve.json
index 866c163..4504cb6 100644
--- a/cve.json
+++ b/cve.json
@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-11-04T00:54:59Z",
+  "build_datetime": "2026-11-04T01:02:01Z",
   "rulesets": [
     {
       "id": "edgeguard-cve",
@@ -17,8 +17,8 @@
           "targets": [
             "uri"
           ],
-          "action": "log",
-          "severity": "high",
+          "action": "block",
+          "severity": "critical",
           "category": "cve",
           "cve": "CVE-2017-9841",
           "enabled": true,
@@ -26,24 +26,7 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
-        },
-        {
-          "id": "CVE-2025-64500-01",
-          "name": "Symfony debug profiler reachable",
-          "pattern": "(?i)/_profiler/",
-          "targets": [
-            "uri"
-          ],
-          "action": "log",
-          "severity": "high",
-          "category": "cve",
-          "cve": "CVE-2025-64500",
-          "enabled": true,
-          "references": [
-            "https://nvd.nist.gov/vuln/detail/CVE-2025-64500"
-          ],
-          "origin": "written by hand: the importer skipped it because the literal is ten characters, and that threshold is right in general. Here the path IS the fault \u2014 a reachable profiler leaks routes, config and request history \u2014 so a request for it is never ordinary traffic."
+          "origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine \u2014 the decision is severity-derived score against the tenant threshold \u2014 so a sub-threshold rule neither blocks nor records anything."
         }
       ]
     }