diff --git a/.trivyignore b/.trivyignore
index 6b0a57e..b5dff8a 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -20,3 +20,18 @@ CVE-2026-22184 exp:2026-09-09
 # 2.8.3+); forcing it across the major breaks the create-react-app build. Suppressing until
 # react-scripts is upgraded/removed. See: UID2-7555 (fix precedent UID2-6698)
 GHSA-2p49-hgcm-8545 exp:2026-08-23
+
+# CVE-2026-18446 — fast-uri (transitive via ajv) (HIGH).
+# Not exploitable here: react-client-side resolves fast-uri 3.1.4 (prod, via ajv build
+# tooling); client-server & google-secure-signals server-side resolve 3.1.2 dev-only; no direct
+# fast-uri import; sample-app build/dev tooling
+# See: UID2-7633
+CVE-2026-18446 exp:2026-11-06
+
+# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH).
+# Not exploitable here: web-integrations/server-side/package-lock.json:600 brace-
+# expansion@5.0.8 via minimatch@10.2.4 (dev/build tooling); server.js requires only
+# axios/express/cookie-session/ejs/nocache/crypto; no minimatch/glob/brace-expansion on request
+# path
+# See: UID2-7619
+CVE-2026-69152 exp:2026-11-06