From 2aa04b3e521ff3882765e0e9c5c67e566f4da5ca Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 1 Aug 2026 13:07:01 -0400
Subject: [PATCH] GHSA/SYNC: 3 updated advisories

---
 gems/guard-livereload/CVE-2016-1000305.yml | 9 ++++++++-
 gems/msgpack/CVE-2026-54522.yml            | 5 +++++
 gems/savon/CVE-2026-53510.yml              | 2 ++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/gems/guard-livereload/CVE-2016-1000305.yml b/gems/guard-livereload/CVE-2016-1000305.yml
index 3ee2ec7fd5..af4867c626 100644
--- a/gems/guard-livereload/CVE-2016-1000305.yml
+++ b/gems/guard-livereload/CVE-2016-1000305.yml
@@ -1,6 +1,7 @@
 ---
 gem: guard-livereload
 cve: 2016-1000305
+ghsa: g65v-27r3-5p6m
 url: https://security.snyk.io/vuln/SNYK-RUBY-GUARDLIVERELOAD-20361
 title: Directory traversal vulnerability in guard-livereload
 date: 2016-02-04
@@ -20,6 +21,7 @@ description: |
   A directory traversal vulnerability exists in
   guard-livereload before version 2.5.2.
 cvss_v3: 5.3
+cvss_v4: 6.9
 patched_versions:
   - ">= 2.5.2"
 related:
@@ -33,12 +35,14 @@ related:
     - https://github.com/guard/guard-livereload/issues/159
     - https://github.com/rubysec/ruby-advisory-db/issues/289
     - https://github.com/rubysec/ruby-advisory-db/pull/1026
+    - https://advisories.gitlab.com/gem/guard-livereload/CVE-2016-1000305
+    - https://github.com/advisories/GHSA-g65v-27r3-5p6m
 notes: |
   - 1/11/2026, 6/8/2026 Notes
     - 1. Deal with cve-2016-1000305
          - real, reserved, published?(NONE OF THE ABOVE)
            - (DEAD) https://cve.report/CVE-2016-1000305 (CVE NOT PUBLISHED)
-    - 2. No GHSA for guard-livereload gem. (checked/fyi)
+    - 2. (UPDATED) No GHSA for guard-livereload gem. (checked/fyi)
     - 3. "date: 2016-02-03" came from gem release date. (fyi)
     - 4. Pick which description: text to use. (done)
     - 5. Check "unaffected_versions:" and "patched_versions:" values. (done)
@@ -54,3 +58,6 @@ notes: |
     - WARNING: The gem has not been released after fixing this
        vulnerability in version 2.5.2.
        - Users should consider migrating to rack-livereload as an alternative.
+  - 8/11/2026
+    - 1. Added GHSA.
+    - 2. cvss_v4 came from GHSA
diff --git a/gems/msgpack/CVE-2026-54522.yml b/gems/msgpack/CVE-2026-54522.yml
index b91589a304..32a38a9b5e 100644
--- a/gems/msgpack/CVE-2026-54522.yml
+++ b/gems/msgpack/CVE-2026-54522.yml
@@ -18,6 +18,7 @@ description: |
   cleared-and-rewritten buffer discloses the second buffer's bytes — a
   same-process use-after-free with cross-buffer information
   disclosure (and the symmetric write-corruption).
+cvss_v4: 2.1
 patched_versions:
   - ">= 1.8.2"
 related:
@@ -25,6 +26,10 @@ related:
     - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522
     - https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog
     - https://github.com/msgpack/msgpack-ruby/compare/v1.8.1...v1.8.2
+    - https://advisories.gitlab.com/gem/msgpack/CVE-2026-54522
+    - https://osv.dev/vulnerability/GHSA-4mrv-5p47-p938
     - https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938
+    - https://github.com/advisories/GHSA-4mrv-5p47-p938
 notes: |
   - CVE is reserved, but not published so no cvss values.
+  - cvss_v4 from GHSA
diff --git a/gems/savon/CVE-2026-53510.yml b/gems/savon/CVE-2026-53510.yml
index 4128f8b6bb..0ac7bbf795 100644
--- a/gems/savon/CVE-2026-53510.yml
+++ b/gems/savon/CVE-2026-53510.yml
@@ -28,7 +28,9 @@ related:
     - https://github.com/savonrb/savon/blob/main/CHANGELOG.md#2172---2026-06-10
     - https://github.com/savonrb/savon/blob/v2.17.1/lib/savon/model.rb#L30-L45
     - https://gist.github.com/connorshea/6cdc951abe0e1ffd2d1cc0fa7cd6b74d
+    - https://advisories.gitlab.com/gem/savon/CVE-2026-53510
     - https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg
+    - https://github.com/advisories/GHSA-mx5j-mp4f-g8jg
 notes: |
   - Found CVE # in CHANGELOG file.
   - CVE is reserved, but not published so no non-GHSA cvss values.