Correct the phpunit rule origin

cve.json

@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-11-08T22:24:33Z",
+  "build_datetime": "2026-11-08T22:58:47Z",
   "rulesets": [
     {
       "id": "edgeguard-cve",
@@ -48,6 +48,24 @@
           ],
           "origin": "imported from the Nuclei template by tools/nuclei-importer, then promoted to block by hand. Its path is a file that should never be web-reachable, so a request for it is the attack and there is nothing legitimate to refuse. The other rules in this channel carry action \"log\": the engine records those and adds nothing to the anomaly score, so they cannot refuse anything on their own."
         },
+        {
+          "id": "CVE-2026-0770-N1",
+          "name": "Langflow \u003c 1.3.0 - Remote Code Execution via validate_code() exec()",
+          "pattern": "(?i)\\{\"code\":\"\\\\ndef exploit\\(\\\\n    _=\\( lambda r: \\(_ for _ in \\(\\)\\)\\.throw\\(Exception\\(f\\\\\"OUTPUT:\\\\\\\\n\\{r\\.stdout\\}\\{r\\.stderr\\}\\\\\"\\)\\) \\)\\(\\\\n        __import__\\('subprocess'\\)\\.run\\('cat /etc/passwd', shell=True, capture_output=",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-0770",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-0770",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-0770.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
         {
           "id": "CVE-2026-104935-N1",
           "name": "Ivanti Connect Secure \u003c= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",
@@ -84,6 +102,24 @@
           ],
           "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
         },
+        {
+          "id": "CVE-2026-10520-N1",
+          "name": "Ivanti Sentry - OS Command Injection",
+          "pattern": "(?i)message=execute system /configuration/system/commandexec \u003ccommandexec\u003e\u003cindex\u003e1\u003c/index\u003e\u003creqandres\u003eecho",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-10520",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-10520",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-10520.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
         {
           "id": "CVE-2026-110447-N1",
           "name": "Collabora Built-in CODE Server \u003c 26.4.303 - OS Command Injection",
@@ -138,6 +174,42 @@
           ],
           "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
         },
+        {
+          "id": "CVE-2026-63077-N1",
+          "name": "JetBrains TeamCity \u003c 2026.1.3, 2025.11.7 - Remote Code Execution",
+          "pattern": "(?i)\\.jspws'\u003c/string\u003e\u003c/connectionInitSqls\u003e\u003caccessToUnderlyingConnectionAllowed\u003efalse\u003c/accessToUnderlyingConnectionAllowed\u003e\u003cmaxConnLifetimeMillis\u003e-1\u003c/maxConnLifetimeMillis\u003e\u003clogExpiredConnections\u003etrue\u003c/logEx",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-63077",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-63077",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-63077.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-72898-N1",
+          "name": "Metabase - Unauthenticated SQL Injection",
+          "pattern": "(?i)Aa1!\",\"user-id\":\\{\"select\":\\[\"id\"\\],\"from\":\\[\"core_user\"\\],\"where\":\\[\"=\",\"is_superuser\",true\\],\"limit\":1\\}\\}",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-72898",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-72898",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-72898.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
         {
           "id": "CVE-2026-75650-N1",
           "name": "Adobe Commerce/Magento \u003c= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI",
@@ -156,6 +228,24 @@
           ],
           "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
         },
+        {
+          "id": "CVE-2026-8037-N1",
+          "name": "Progress ADC LoadMaster - Command Injection",
+          "pattern": "(?i)\\{\"cmd\": \"getall\", \"apiuser\": \"''''\", \"apipass\": \"BBBBB\", \"g0\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g1\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g2\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g3\":",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-8037",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-8037",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-8037.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
         {
           "id": "CVE-2026-87902-N1",
           "name": "WordPress Core - PHP Template Path Traversal",
@@ -173,6 +263,42 @@
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-87902.yaml"
           ],
           "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-93616-N1",
+          "name": "Check Point Security Management - Unauthenticated Directory Traversal to RCE",
+          "pattern": "(?i)\u003c\\?xml version=\"1\\.0\"\\?\u003e\u003csoap:Envelope xmlns:soap=\"http://schemas\\.xmlsoap\\.org/soap/envelope/\"\u003e\u003csoap:Body\u003e\u003cloginAsApplicationReadOnlyPublicSession xmlns=\"http://www\\.checkpoint\\.com/DleWebService/UpgradeSvc",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-93616",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-93616",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-93616.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-9586-N1",
+          "name": "Sangoma Switchvox \u003c 8.4.0.2 - Unauthenticated SQL Injection",
+          "pattern": "(?i)\u003crequest\u003e\u003cPhoneIP\u003e10\\.0\\.0\\.1'; COPY \\(SELECT ''\\) TO PROGRAM 'nslookup",
+          "targets": [
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-9586",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-9586",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-9586.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
         }
       ]
     }