diff --git a/cve.json b/cve.json
index d6bed7f..37477ad 100644
--- a/cve.json
+++ b/cve.json
@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-11-04T15:00:48Z",
+  "build_datetime": "2026-11-08T16:48:55Z",
   "rulesets": [
     {
       "id": "edgeguard-cve",
@@ -10,6 +10,26 @@
       "enabled": true,
       "priority": 1,
       "rules": [
+        {
+          "id": "CVE-2016-3081-M1",
+          "name": "Apache Struts S2-032 - OGNL execution via the method: prefix",
+          "pattern": "(?i)method:#_memberAccess=@ognl\\.OgnlContext@DEFAULT_MEMBER_ACCESS",
+          "targets": [
+            "uri",
+            "query",
+            "body"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2016-3081",
+          "enabled": true,
+          "references": [
+            "https://cwiki.apache.org/confluence/display/WW/S2-032",
+            "https://nvd.nist.gov/vuln/detail/CVE-2016-3081"
+          ],
+          "origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"&cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does."
+        },
         {
           "id": "CVE-2017-9841-N1",
           "name": "PHPUnit - Remote Code Execution",
@@ -26,7 +46,97 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine \u2014 the decision is severity-derived score against the tenant threshold \u2014 so a sub-threshold rule neither blocks nor records anything."
+          "origin": "imported from the Nuclei template by tools/nuclei-importer. Severity is critical deliberately: it is what makes the rule act at all. The action field is not read by the engine — the decision is severity-derived score against the tenant threshold — so a sub-threshold rule neither blocks nor records anything."
+        },
+        {
+          "id": "CVE-2026-104935-N1",
+          "name": "Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",
+          "pattern": "(?i)X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu\\.cgi",
+          "targets": [
+            "headers"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-104935",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-104935",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-104935.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-105134-N1",
+          "name": "AhsayCBS <= 10.3.4 - Unauthenticated RCE",
+          "pattern": "(?i)\\.\\./\\.\\./webapps/rps\"\\)\\}\\}",
+          "targets": [
+            "headers"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-105134",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-105134",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-105134.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-110447-N1",
+          "name": "Collabora Built-in CODE Server < 26.4.303 - OS Command Injection",
+          "pattern": "(?i)/\\.\\./apps/richdocumentscode_arm64/proxy\\.php",
+          "targets": [
+            "uri"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-110447",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-110447.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-21589-N1",
+          "name": "Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read",
+          "pattern": "(?i)/1\\.0/_/download/resources/com\\.atlassian\\.bitbucket\\.server\\.bitbucket-webpack-INTERNAL:avatar/avatar/\\.\\.::\\.\\.::\\.\\.::\\.\\.::\\.\\.::WEB-INF::urlrewrite\\.xml",
+          "targets": [
+            "uri"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-21589",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-21589.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+        },
+        {
+          "id": "CVE-2026-87902-N1",
+          "name": "WordPress Core - PHP Template Path Traversal",
+          "pattern": "(?i)pagename=templates/\\.\\./\\.\\./\\.\\./\\.\\./wp-includes/theme-compat/footer",
+          "targets": [
+            "query"
+          ],
+          "action": "log",
+          "severity": "high",
+          "category": "cve",
+          "cve": "CVE-2026-87902",
+          "enabled": true,
+          "references": [
+            "https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
+            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-87902.yaml"
+          ],
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
         }
       ]
     }