Merge pull request #1245 from jasnow/ghsa-syncbot-2026-09-23-11_10_43

GHSA/SYNC: 3 modified (2 of 3 were renamed) advisories

@simi - Thanks for reviewing and approving this PR.

Author: jasnow

gems/mpxj/CVE-2026-61570.yml

@@ -2,7 +2,7 @@
 gem: mpxj
 cve: 2026-61570
 ghsa: 5vvx-3h34-f3gj
-url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-61570
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-61570
 title: XXE Vulnerability in MerlinReader
 date: 2026-06-22
 description: |
@@ -30,11 +30,13 @@ patched_versions:
   - ">= 16.4.1"
 related:
   url:
-    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-61570
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-61570
     - https://rubygems.org/gems/mpxj/versions/16.4.1
     - https://github.com/joniles/mpxj/releases/tag/v16.4.1
+    - https://github.com/joniles/mpxj/blob/master/CHANGELOG.md#1641-2026-06-22
+    - https://osv.dev/vulnerability/GHSA-5vvx-3h34-f3gj
     - https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj
+    - https://github.com/advisories/GHSA-5vvx-3h34-f3gj
 notes: |
-  - CVE is reserved, but not published.
-  - cvss_v3 value from GHSA.
-  - data from gem release date.
+  - cvss_v3 from GHSA and nvd.nist.gov URLs.
+  - date from gem release date.

gems/mpxj/GHSA-7952-gx68-cjqr.yml gems/mpxj/CVE-2026-65829.ymlgems/mpxj/GHSA-7952-gx68-cjqr.yml renamed to gems/mpxj/CVE-2026-65829.yml

@@ -1,7 +1,8 @@
 ---
 gem: mpxj
+cve: 2026-65829
 ghsa: 7952-gx68-cjqr
-url: https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-65829
 title: Potential Path Traversal Vulnerability in Primavera P3 PRX and
   SureTrak STX readers
 date: 2026-07-03
@@ -21,9 +22,13 @@ patched_versions:
   - ">= 16.5.0"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-65829
     - https://rubygems.org/gems/mpxj/versions/16.5.0
     - https://github.com/joniles/mpxj/releases/tag/v16.5.0
+    - https://github.com/joniles/mpxj/blob/master/CHANGELOG.md#1650-2026-07-03
+    - https://github.com/joniles/mpxj/commit/4347315afab1ef5a2907978a754fbc5b0ff58e6f
     - https://github.com/joniles/mpxj/security/advisories/GHSA-7952-gx68-cjqr
+    - https://github.com/advisories/GHSA-7952-gx68-cjqr
 notes: |
-  - No CVE.
-  - cvss_v3 value from GHSA
+  - cvss_v3 from GHSA and nvd.nist.gov URLs.
+  - date from rubygems.org URL.

gems/spree_api/GHSA-4825-p4xm-pcf2.yml gems/spree_api/CVE-2026-94462.ymlgems/spree_api/GHSA-4825-p4xm-pcf2.yml renamed to gems/spree_api/CVE-2026-94462.yml

@@ -1,7 +1,8 @@
 ---
 gem: spree_api
+cve: 2026-94462
 ghsa: 4825-p4xm-pcf2
-url: https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-94462
 title: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
 date: 2026-07-20
 description: |
@@ -53,13 +54,19 @@ patched_versions:
   - ">= 5.5.4"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-94462
     - https://rubygems.org/gems/spree_api/versions/5.5.4
-      - https://github.com/spree/spree/releases/tag/v5.5.4
+    - https://github.com/spree/spree/releases/tag/v5.5.4
+    - https://github.com/spree/spree/commit/af0d1a2d582a60d179de65b7d3ea024cb26426a8
     - https://rubygems.org/gems/spree_api/versions/5.4.4
-      - https://github.com/spree/spree/releases/tag/v5.4.4
+    - https://github.com/spree/spree/releases/tag/v5.4.4
+    - https://github.com/spree/spree/commit/8834230a1f47bb5988f23f45dbd162776cf592bd
+    - https://github.com/spree/spree/pull/14314
+    - https://advisories.gitlab.com/gem/spree_api/CVE-2026-94462
+    - https://osv.dev/vulnerability/GHSA-4825-p4xm-pcf2
     - https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
+    - https://github.com/advisories/GHSA-4825-p4xm-pcf2
 notes: |
   - NOTE: Gem name is "spree_api" but repo name is "spree".
-  - cvss_v3 from project GHSA
-  - No CVE in project GHSA
+  - cvss_v3 from GHSA and nvd.nist.gov URLs.
   - date field is rubygems.org release date.