From 8417dbfcb4ffcda067a5ecd24f1c872d7112f308 Mon Sep 17 00:00:00 2001
From: "andre.bolinhas" <andre.bolinhas@articatech.com>
Date: Wed, 4 Nov 2026 00:55:16 +0000
Subject: [PATCH] Publish CVE channel (2026-11-04T00:54:59Z)

Validated against the engine's TestPublishedFeedDoesNotDuplicateACompiledRule guard.
Entries carrying an id: 3
---
 cve.json | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/cve.json b/cve.json
index 145454c..866c163 100644
--- a/cve.json
+++ b/cve.json
@@ -1,4 +1,51 @@
 {
-  "build_datetime": "2026-11-03T01:04:52Z",
-  "rulesets": []
+  "build_datetime": "2026-11-04T00:54:59Z",
+  "rulesets": [
+    {
+      "id": "edgeguard-cve",
+      "name": "EdgeGuard CVE Virtual Patches",
+      "version": "1",
+      "source": "edgeguard-cve",
+      "description": "Virtual patches for named vulnerabilities",
+      "enabled": true,
+      "priority": 1,
+      "rules": [
+        {
+          "id": "CVE-2017-9841-N1",
+          "name": "PHPUnit - Remote Code Execution",
+          "pattern": "(?i)/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin\\.php",
+          "targets": [
+            "uri"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2017-9841",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2025-64500-01",
+          "name": "Symfony debug profiler reachable",
+          "pattern": "(?i)/_profiler/",
+          "targets": [
+            "uri"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2025-64500",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2025-64500"
+          ],
+          "origin": "written by hand: the importer skipped it because the literal is ten characters, and that threshold is right in general. Here the path IS the fault \u2014 a reachable profiler leaks routes, config and request history \u2014 so a request for it is never ordinary traffic."
+        }
+      ]
+    }
+  ]
 }