Updated advisory posts against rubysec/ruby-advisory-db@6177cf5

Author: jasnow

advisories/_posts/2025-10-07-CVE-2025-61594.md

@@ -9,7 +9,7 @@ advisory:
   gem: uri
   cve: 2025-61594
   ghsa: j4pr-3wm6-xx2r
-  url: https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594
+  url: https://github.com/advisories/GHSA-j4pr-3wm6-xx2r
   title: CVE-2025-61594 - URI Credential Leakage Bypass over CVE-2025-27221
   date: 2025-10-07
   description: |-
@@ -35,15 +35,19 @@ advisory:
 
     Thanks to junfuchong (chongfujun) for discovering this issue.
     Also thanks to nobu for additional fixes of this vulnerability.
+  cvss_v3: 7.5
+  cvss_v4: 2.1
   patched_versions:
   - "~> 0.12.5"
   - "~> 0.13.3"
   - ">= 1.0.4"
   related:
     url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-61594
     - https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594
     - https://rubygems.org/gems/uri/versions/1.0.4
     - https://rubygems.org/gems/uri/versions/0.13.3
     - https://rubygems.org/gems/uri/versions/0.12.5
     - https://github.com/ruby/uri
+    - https://github.com/advisories/GHSA-j4pr-3wm6-xx2r
 ---

advisories/_posts/2026-03-10-CVE-2026-1776.md

@@ -26,6 +26,7 @@ advisory:
     access sensitive files such as /etc/passwd. This issue represents a
     bypass of the incomplete fix for CVE-2024-46987 and affects
     deployments using the AWS S3 storage backend.
+  cvss_v3: 6.5
   cvss_v4: 6.0
   unaffected_versions:
   - "< 2.4.5.0"

advisories/_posts/2026-03-25-CVE-2026-33658.md

@@ -22,12 +22,15 @@ advisory:
     ranges in an HTTP Range header. A request with thousands of small
     ranges causes disproportionate CPU usage compared to a normal
     request for the same file, possibly resulting in a DoS vulnerability.
+  cvss_v3: 6.5
+  cvss_v4: 2.3
   patched_versions:
   - "~> 7.2.3, >= 7.2.3.1"
   - "~> 8.0.4, >= 8.0.4.1"
   - ">= 8.1.2.1"
   related:
     url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-33658
     - https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906
     - https://rubyonrails.org/2026/3/23/Rails-Versions-7-2-3-1-8-0-4-1-and-8-1-2-1-have-been-released
     - https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06.patch

advisories/_posts/2026-04-13-CVE-2026-23891.md

@@ -38,11 +38,14 @@ advisory:
     [octree](https://octree.ch/) and made by
     [Secu Labs](https://seculabs.ch/) against Decidim financed
     by the city of Lausanne (Switzerland).
+  cvss_v3: 8.7
+  cvss_v4: 9.3
   patched_versions:
   - "~> 0.30.5"
   - ">= 0.31.1"
   related:
     url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-23891
     - https://github.com/decidim/decidim/releases/tag/v0.31.1
     - https://github.com/decidim/decidim/releases/tag/v0.30.5
     - https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g