diff --git a/advisories/unreviewed/2025/04/GHSA-2fg7-5jv3-82cc/GHSA-2fg7-5jv3-82cc.json b/advisories/unreviewed/2025/04/GHSA-2fg7-5jv3-82cc/GHSA-2fg7-5jv3-82cc.json
new file mode 100644
index 00000000000..a071721492e
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-2fg7-5jv3-82cc/GHSA-2fg7-5jv3-82cc.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2fg7-5jv3-82cc",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-24907"
+  ],
+  "details": "Overview \n\n\n\n \n\n\n\nThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nThis allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24907"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35781624069005--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24907"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-35"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-45f2-pvp6-f6hv/GHSA-45f2-pvp6-f6hv.json b/advisories/unreviewed/2025/04/GHSA-45f2-pvp6-f6hv/GHSA-45f2-pvp6-f6hv.json
new file mode 100644
index 00000000000..2d1582fd3f2
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-45f2-pvp6-f6hv/GHSA-45f2-pvp6-f6hv.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-45f2-pvp6-f6hv",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-43704"
+  ],
+  "details": "Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43704"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.veritas.com/support/en_US/security/ARC25-006"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-319"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-485r-phmq-84vw/GHSA-485r-phmq-84vw.json b/advisories/unreviewed/2025/04/GHSA-485r-phmq-84vw/GHSA-485r-phmq-84vw.json
new file mode 100644
index 00000000000..be588b454e7
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-485r-phmq-84vw/GHSA-485r-phmq-84vw.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-485r-phmq-84vw",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-24908"
+  ],
+  "details": "Overview \n\n\n\n \n\n\n\nThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nThis allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24908"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35783399569421--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24908"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-35"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-53v5-rqv5-2287/GHSA-53v5-rqv5-2287.json b/advisories/unreviewed/2025/04/GHSA-53v5-rqv5-2287/GHSA-53v5-rqv5-2287.json
new file mode 100644
index 00000000000..cf037c13386
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-53v5-rqv5-2287/GHSA-53v5-rqv5-2287.json
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-53v5-rqv5-2287",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-2400"
+  ],
+  "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2400"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-634v-x2r3-jm25/GHSA-634v-x2r3-jm25.json b/advisories/unreviewed/2025/04/GHSA-634v-x2r3-jm25/GHSA-634v-x2r3-jm25.json
new file mode 100644
index 00000000000..f3dd88891da
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-634v-x2r3-jm25/GHSA-634v-x2r3-jm25.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-634v-x2r3-jm25",
+  "modified": "2025-04-17T00:30:25Z",
+  "published": "2025-04-17T00:30:25Z",
+  "aliases": [
+    "CVE-2025-43703"
+  ],
+  "details": "An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43703"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ankitects/anki/pull/3925"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-830"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T22:15:15Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-6hg2-95ww-whj9/GHSA-6hg2-95ww-whj9.json b/advisories/unreviewed/2025/04/GHSA-6hg2-95ww-whj9/GHSA-6hg2-95ww-whj9.json
new file mode 100644
index 00000000000..af6d5757c70
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-6hg2-95ww-whj9/GHSA-6hg2-95ww-whj9.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6hg2-95ww-whj9",
+  "modified": "2025-04-17T00:30:25Z",
+  "published": "2025-04-17T00:30:25Z",
+  "aliases": [
+    "CVE-2025-0756"
+  ],
+  "details": "Overview \n\n\n\n \n\n\n\nThe product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not restrict JNDI identifiers during the creation of platform data sources. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nAn attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0756"
+    },
+    {
+      "type": "WEB",
+      "url": "https://https://support.pentaho.com/hc/en-us/articles/35771876077709--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0756"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-99"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:44Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-728w-fq42-m52c/GHSA-728w-fq42-m52c.json b/advisories/unreviewed/2025/04/GHSA-728w-fq42-m52c/GHSA-728w-fq42-m52c.json
new file mode 100644
index 00000000000..d92b35bd480
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-728w-fq42-m52c/GHSA-728w-fq42-m52c.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-728w-fq42-m52c",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-24910"
+  ],
+  "details": "Overview \n\n\n\n \n\n\n\nXML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nBy submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24910"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35782683750541--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24910"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-611"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-fqgg-8qcm-j2cr/GHSA-fqgg-8qcm-j2cr.json b/advisories/unreviewed/2025/04/GHSA-fqgg-8qcm-j2cr/GHSA-fqgg-8qcm-j2cr.json
new file mode 100644
index 00000000000..6f3c00c6af0
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-fqgg-8qcm-j2cr/GHSA-fqgg-8qcm-j2cr.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fqgg-8qcm-j2cr",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-24911"
+  ],
+  "details": "Overview \n\n\n\n \n\n\n\nXML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Data Access XMLParserFactoryProducer against out-of-band XML External Entity Reference. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nBy submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24911"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35783689016589--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24911"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-611"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-gm22-hqvw-7j52/GHSA-gm22-hqvw-7j52.json b/advisories/unreviewed/2025/04/GHSA-gm22-hqvw-7j52/GHSA-gm22-hqvw-7j52.json
new file mode 100644
index 00000000000..8793d803759
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-gm22-hqvw-7j52/GHSA-gm22-hqvw-7j52.json
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gm22-hqvw-7j52",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:25Z",
+  "aliases": [
+    "CVE-2025-1566"
+  ],
+  "details": "DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 129.0.6668.36 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1566"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.chromium.org/issues/b/342802975"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issuetracker.google.com/issues/342802975"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:44Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-h4fr-qhv5-6jfq/GHSA-h4fr-qhv5-6jfq.json b/advisories/unreviewed/2025/04/GHSA-h4fr-qhv5-6jfq/GHSA-h4fr-qhv5-6jfq.json
new file mode 100644
index 00000000000..4c8ed4e2334
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-h4fr-qhv5-6jfq/GHSA-h4fr-qhv5-6jfq.json
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h4fr-qhv5-6jfq",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-1568"
+  ],
+  "details": "Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 131.0.6778.268 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service  via editing trusted pipelines by insufficient access controls and misconfigurations in Gerrit's project.config.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1568"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.chromium.org/issues/b/374279912"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issuetracker.google.com/issues/374279912"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:44Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-mfp7-fc9g-2pqp/GHSA-mfp7-fc9g-2pqp.json b/advisories/unreviewed/2025/04/GHSA-mfp7-fc9g-2pqp/GHSA-mfp7-fc9g-2pqp.json
new file mode 100644
index 00000000000..54d17441d84
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-mfp7-fc9g-2pqp/GHSA-mfp7-fc9g-2pqp.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mfp7-fc9g-2pqp",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-0758"
+  ],
+  "details": "Overview \n\n\n\nThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) \n\n\n\nDescription \n\n\n\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default. \n\n\n\nImpact \n\n\n\nWhen the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0758"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-732"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:44Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-mhjg-qmr3-w2xc/GHSA-mhjg-qmr3-w2xc.json b/advisories/unreviewed/2025/04/GHSA-mhjg-qmr3-w2xc/GHSA-mhjg-qmr3-w2xc.json
new file mode 100644
index 00000000000..f110a1486c9
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-mhjg-qmr3-w2xc/GHSA-mhjg-qmr3-w2xc.json
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mhjg-qmr3-w2xc",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-1704"
+  ],
+  "details": "ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 124.0.6367.34 on Chromebooks allows enrolled users with local access to unenroll devices \nand intercept device management requests via loading components from the unencrypted stateful partition.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1704"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.chromium.org/issues/b/359915523"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issuetracker.google.com/issues/359915523"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:44Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-mr4q-xr2r-f58c/GHSA-mr4q-xr2r-f58c.json b/advisories/unreviewed/2025/04/GHSA-mr4q-xr2r-f58c/GHSA-mr4q-xr2r-f58c.json
new file mode 100644
index 00000000000..69ede3ed604
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-mr4q-xr2r-f58c/GHSA-mr4q-xr2r-f58c.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mr4q-xr2r-f58c",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:25Z",
+  "aliases": [
+    "CVE-2025-0757"
+  ],
+  "details": "Overview\n\n\n\n \n\n\n\nThe software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nOnce the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0757"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0757"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:44Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-pv63-22w8-6xj8/GHSA-pv63-22w8-6xj8.json b/advisories/unreviewed/2025/04/GHSA-pv63-22w8-6xj8/GHSA-pv63-22w8-6xj8.json
new file mode 100644
index 00000000000..e36afc2c5f8
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-pv63-22w8-6xj8/GHSA-pv63-22w8-6xj8.json
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pv63-22w8-6xj8",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-2073"
+  ],
+  "details": "Out-of-Bounds Read in ip_set_bitmap_ip.c in Google ChromeOS Kernel Versions 6.1, 5.15, 5.10, 5.4, 4.19. on All devices where Termina is used allows an attacker with CAP_NET_ADMIN privileges to cause memory corruption and potentially escalate privileges via crafted ipset commands.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2073"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.chromium.org/issues/b/380043638"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issuetracker.google.com/issues/380043638"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-x2mw-2wm2-5876/GHSA-x2mw-2wm2-5876.json b/advisories/unreviewed/2025/04/GHSA-x2mw-2wm2-5876/GHSA-x2mw-2wm2-5876.json
new file mode 100644
index 00000000000..e1712b91119
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-x2mw-2wm2-5876/GHSA-x2mw-2wm2-5876.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x2mw-2wm2-5876",
+  "modified": "2025-04-17T00:30:26Z",
+  "published": "2025-04-17T00:30:26Z",
+  "aliases": [
+    "CVE-2025-24909"
+  ],
+  "details": "Overview \n\n\n\n \n\n\n\nThe software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) \n\n\n\n \n\n\n\nDescription \n\n\n\n \n\n\n\nHitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. \n\n\n\n \n\n\n\nImpact \n\n\n\n \n\n\n\nOnce the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24909"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.pentaho.com/hc/en-us/articles/35782541484045--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24909"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T23:15:45Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-x2pf-6jgf-xvvw/GHSA-x2pf-6jgf-xvvw.json b/advisories/unreviewed/2025/04/GHSA-x2pf-6jgf-xvvw/GHSA-x2pf-6jgf-xvvw.json
new file mode 100644
index 00000000000..4b653ad28f6
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-x2pf-6jgf-xvvw/GHSA-x2pf-6jgf-xvvw.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x2pf-6jgf-xvvw",
+  "modified": "2025-04-17T00:30:25Z",
+  "published": "2025-04-17T00:30:25Z",
+  "aliases": [
+    "CVE-2025-25230"
+  ],
+  "details": "Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is installed may be able to elevate privileges.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25230"
+    },
+    {
+      "type": "WEB",
+      "url": "https://static.omnissa.com/sites/default/files/OMSA-2025-0001.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.omnissa.com/omnissa-security-response"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-16T22:15:14Z"
+  }
+}
\ No newline at end of file