diff --git a/advisories/github-reviewed/2024/11/GHSA-2x2g-32r7-p4x8/GHSA-2x2g-32r7-p4x8.json b/advisories/github-reviewed/2024/11/GHSA-2x2g-32r7-p4x8/GHSA-2x2g-32r7-p4x8.json
index 609aeed1e0c..7a578d1450c 100644
--- a/advisories/github-reviewed/2024/11/GHSA-2x2g-32r7-p4x8/GHSA-2x2g-32r7-p4x8.json
+++ b/advisories/github-reviewed/2024/11/GHSA-2x2g-32r7-p4x8/GHSA-2x2g-32r7-p4x8.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2x2g-32r7-p4x8",
-  "modified": "2024-11-19T18:02:57Z",
+  "modified": "2024-11-19T20:50:18Z",
   "published": "2024-11-19T09:30:54Z",
   "aliases": [
     "CVE-2024-31141"
@@ -9,6 +9,10 @@
   "summary": "Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider",
   "details": "Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\n\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\n\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\n\n\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.\n\n\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
diff --git a/advisories/github-reviewed/2024/11/GHSA-7q7g-4xm8-89cq/GHSA-7q7g-4xm8-89cq.json b/advisories/github-reviewed/2024/11/GHSA-7q7g-4xm8-89cq/GHSA-7q7g-4xm8-89cq.json
index 04c71cd00d2..f1043a0cfd0 100644
--- a/advisories/github-reviewed/2024/11/GHSA-7q7g-4xm8-89cq/GHSA-7q7g-4xm8-89cq.json
+++ b/advisories/github-reviewed/2024/11/GHSA-7q7g-4xm8-89cq/GHSA-7q7g-4xm8-89cq.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7q7g-4xm8-89cq",
-  "modified": "2024-11-19T15:47:27Z",
+  "modified": "2024-11-19T20:49:57Z",
   "published": "2024-11-15T20:47:31Z",
   "aliases": [
     "CVE-2024-21539"
@@ -59,7 +59,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-1333"
+      "CWE-1333",
+      "CWE-770"
     ],
     "severity": "LOW",
     "github_reviewed": true,
diff --git a/advisories/github-reviewed/2024/11/GHSA-g85v-wf27-67xc/GHSA-g85v-wf27-67xc.json b/advisories/github-reviewed/2024/11/GHSA-g85v-wf27-67xc/GHSA-g85v-wf27-67xc.json
index cc52d3669b6..7772aecc49f 100644
--- a/advisories/github-reviewed/2024/11/GHSA-g85v-wf27-67xc/GHSA-g85v-wf27-67xc.json
+++ b/advisories/github-reviewed/2024/11/GHSA-g85v-wf27-67xc/GHSA-g85v-wf27-67xc.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g85v-wf27-67xc",
-  "modified": "2024-11-19T15:46:30Z",
+  "modified": "2024-11-19T20:50:10Z",
   "published": "2024-11-18T23:48:26Z",
   "aliases": [
     "CVE-2024-52587"
@@ -9,6 +9,10 @@
   "summary": "Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`",
   "details": "### Summary\n\nVersions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. \n\n### Details\n\n1. setup.ts:169 [1]  performs `execSync` with a command that gets\ninvoked after interpretation by the shell. This command includes an\ninterpolated `process.env.USER` variable, which an attacker could\nmodify (without actually creating a new user) to inject arbitrary\nshell expressions into this `execSync`. This may or may not be likely\nin practice, but I believe the hygienic way to perform the underlying\noperation is to use `execFileSync` or similar and bypass the\nunderlying shell evaluation.\n\n2. setup.ts:229 [2] has a nearly identical `execSync` to (1) above,\nbut with `$USER` for shell-level interpolation rather than string\ninterpolation. However, this is still injectable and would be best\nreplaced by an `execFileSync`, per above.\n\n3. arc-runner:40-44 [3] has an `execSync` with multiple string\ninterpolations. Most of these do not appear immediately injectible\n(since they appear to come from presumed trusted API responses), but\nthe expansion of `getRunnerTempDir()` may be injectable due to its\ndependence on potentially attacker-controllable environment variables\n(e.g. `RUNNER_TEMP`). The underlying operation appears to be a trivial\nfile copy, so this entire subprocess should in theory be replaceable\nwith ordinary NodeJS `fs` API calls instead.\n\n4. arc-runner:53 [4] demonstrates the same weakness, and has the same\nresolution as (3).\n\n5. arc-runner:57 demonstrates the same weakness as (3) and (4), and\nhas the same resolution.\n\n6. arc-runner:61 demonstrates the same weakness as (3), (4), and (5),\nand has the same resolution.\n\n\n[1]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L169\n\n[2]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L229\n\n[3]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44\n\n[4]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L53\n\n[5]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L57\n\n[6]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L61",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
diff --git a/advisories/github-reviewed/2024/11/GHSA-p7f6-8mcm-fwv3/GHSA-p7f6-8mcm-fwv3.json b/advisories/github-reviewed/2024/11/GHSA-p7f6-8mcm-fwv3/GHSA-p7f6-8mcm-fwv3.json
index 7363586e2d0..d47eec0576d 100644
--- a/advisories/github-reviewed/2024/11/GHSA-p7f6-8mcm-fwv3/GHSA-p7f6-8mcm-fwv3.json
+++ b/advisories/github-reviewed/2024/11/GHSA-p7f6-8mcm-fwv3/GHSA-p7f6-8mcm-fwv3.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p7f6-8mcm-fwv3",
-  "modified": "2024-11-19T18:03:07Z",
+  "modified": "2024-11-19T20:50:30Z",
   "published": "2024-11-19T18:03:07Z",
   "aliases": [
     "CVE-2024-52600"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52600"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d"
@@ -67,6 +71,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-11-19T18:03:07Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-11-19T17:15:56Z"
   }
 }
\ No newline at end of file