diff --git a/advisories/github-reviewed/2024/03/GHSA-xcgp-r7r8-2hc9/GHSA-xcgp-r7r8-2hc9.json b/advisories/github-reviewed/2024/03/GHSA-xcgp-r7r8-2hc9/GHSA-xcgp-r7r8-2hc9.json
index 01d5f00900a..3b152abaf07 100644
--- a/advisories/github-reviewed/2024/03/GHSA-xcgp-r7r8-2hc9/GHSA-xcgp-r7r8-2hc9.json
+++ b/advisories/github-reviewed/2024/03/GHSA-xcgp-r7r8-2hc9/GHSA-xcgp-r7r8-2hc9.json
@@ -1,14 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xcgp-r7r8-2hc9",
-  "modified": "2024-03-27T21:57:19Z",
+  "modified": "2024-04-16T15:50:40Z",
   "published": "2024-03-27T18:32:38Z",
   "withdrawn": "2024-03-27T21:57:19Z",
   "aliases": [
     "CVE-2024-1540"
   ],
   "summary": "Gradio's CI vulnerable to Command Injection",
-  "details": "Previously, it was possible to exfiltrate secrets in Gradio's CI, but this is now fixed.",
+  "details": "A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, potentially leading to unauthorized modification of the base repository or secrets exfiltration. The issue arises from the unsafe handling of GitHub context information within a an action definition which is evaluated and substituted before script execution. Remediation involves setting untrusted input values to intermediate environment variables to prevent direct influence on script generation.",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2024/04/GHSA-jhvf-7c85-3c9g/GHSA-jhvf-7c85-3c9g.json b/advisories/github-reviewed/2024/04/GHSA-jhvf-7c85-3c9g/GHSA-jhvf-7c85-3c9g.json
index 1ee006326cc..2ae0a71d80f 100644
--- a/advisories/github-reviewed/2024/04/GHSA-jhvf-7c85-3c9g/GHSA-jhvf-7c85-3c9g.json
+++ b/advisories/github-reviewed/2024/04/GHSA-jhvf-7c85-3c9g/GHSA-jhvf-7c85-3c9g.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jhvf-7c85-3c9g",
-  "modified": "2024-04-02T14:01:01Z",
+  "modified": "2024-04-16T15:49:36Z",
   "published": "2024-04-01T21:30:46Z",
   "aliases": [
     "CVE-2024-3135"
   ],
   "summary": "LocalAI cross-site request forgery vulnerability",
-  "details": "The web server lacked CSRF tokens allowing an attacker to host malicious JavaScript on a host that when visited by a LocalAI user, could allow the attacker to fill disk space to deny service or abuse credits.",
+  "details": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's local LocalAI instance without their consent. This vulnerability enables attackers to exhaust system resources, consume credits, and fill disk space by making numerous resource-intensive API calls, such as generating images or uploading files. The vulnerability stems from the application's acceptance of simple request content-types without requiring CSRF tokens or implementing other CSRF mitigation measures. Successful exploitation does not require network access to the vulnerable LocalAI environment.",
   "severity": [
     {
       "type": "CVSS_V3",