Update README

README.md

@@ -1 +1,26 @@
-# aboutcode-mirror-euvd
+# EUVD Mirror
+
+This repository hosts an **append-only mirror** of the [European Vulnerability Database (EUVD)](https://euvd.enisa.europa.eu/search).
+
+## Sync Frequency
+
+The mirror syncs every day, appending new advisories from EUVD.  
+See the sync pipeline [sync_catalog.py](sync_catalog.py) and workflow 
+[.github/workflows/sync.yml](.github/workflows/sync.yml).
+
+
+## Usage
+
+To use the mirror, clone this repository:
+
+```bash
+git clone https://github.com/aboutcode-org/aboutcode-mirror-euvd
+```
+
+Once cloned, the advisories will be available in the `advisories/` directory organized by `datePublished`.
+
+
+## License
+
+* **Code** is licensed under the [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0).
+* **Data** is licensed under [CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/).

advisories/2026/02/EUVD-2025-207365.json

@@ -2,15 +2,15 @@
   "id": "EUVD-2025-207365",
   "enisaUuid": "e9f8bb1c-ac51-3d2a-ac52-708fe5dbb57a",
   "description": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
-  "datePublished": "Feb 9, 2026, 3:30:31 PM",
-  "dateUpdated": "Feb 9, 2026, 3:30:31 PM",
+  "datePublished": "Feb 9, 2026, 2:51:32 PM",
+  "dateUpdated": "Apr 6, 2026, 7:24:51 AM",
   "baseScore": 5.3,
   "baseScoreVersion": "3.1",
   "baseScoreVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
-  "references": "https://access.redhat.com/security/cve/CVE-2025-14831\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2423177\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14831\n",
+  "references": "https://access.redhat.com/security/cve/CVE-2025-14831\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2423177\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14831\nhttps://access.redhat.com/errata/RHSA-2026:3477\nhttps://access.redhat.com/errata/RHSA-2026:4188\nhttps://access.redhat.com/errata/RHSA-2026:4655\nhttps://access.redhat.com/errata/RHSA-2026:4943\nhttps://access.redhat.com/errata/RHSA-2026:5585\nhttps://access.redhat.com/errata/RHSA-2026:5606\nhttps://access.redhat.com/errata/RHSA-2026:6630\nhttps://gitlab.com/gnutls/gnutls/-/issues/1773\n",
   "aliases": "GHSA-pm8w-jq9r-x5rp\nCVE-2025-14831\n",
   "assigner": "redhat",
-  "epss": 0.07,
+  "epss": 0.06,
   "enisaIdProduct": [
     {
       "id": "349175bc-977b-32b2-93ba-90f89133ab33",
@@ -33,6 +33,13 @@
       },
       "product_version": "patch: 0:3.8.3-10.el9_7"
     },
+    {
+      "id": "82a8bf55-089e-306f-ac2f-233c51671be8",
+      "product": {
+        "name": "Red Hat Enterprise Linux 9.6 Extended Update Support"
+      },
+      "product_version": "patch: 0:3.8.3-6.el9_6.3"
+    },
     {
       "id": "93bbe7b6-a7f4-39a4-af44-2e8ca10ad887",
       "product": {
@@ -61,6 +68,13 @@
       },
       "product_version": "patch: 0:3.6.16-8.el8_10.5"
     },
+    {
+      "id": "d3123fa6-2e8e-3927-8dd7-8a111d70b7a2",
+      "product": {
+        "name": "Red Hat Ceph Storage 8"
+      },
+      "product_version": "patch: sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414"
+    },
     {
       "id": "e92734b5-d598-36f4-96c8-c79c20cbfee7",
       "product": {

advisories/2026/03/EUVD-2024-55470.json

@@ -2,10 +2,10 @@
   "id": "EUVD-2024-55470",
   "enisaUuid": "63b9c87a-f04c-3b99-89be-244dfb6fd763",
   "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/xattr: missing fdput() in fremovexattr error path\n\nIn the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a\nfile reference but returns early without calling fdput() when\nstrncpy_from_user() fails on the name argument. In multi-threaded processes\nwhere fdget() takes the slow path, this permanently leaks one\nfile reference per call, pinning the struct file and associated kernel\nobjects in memory. An unprivileged local user can exploit this to cause\nkernel memory exhaustion. The issue was inadvertently fixed by commit\na71874379ec8 (\"xattr: switch to CLASS(fd)\").",
-  "datePublished": "Mar 9, 2026, 6:31:43 PM",
-  "dateUpdated": "Mar 9, 2026, 6:31:43 PM",
+  "datePublished": "Mar 9, 2026, 3:51:12 PM",
+  "dateUpdated": "Apr 6, 2026, 8:01:13 AM",
   "baseScore": 0.0,
-  "references": "https://git.kernel.org/stable/c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-14027\n",
+  "references": "https://git.kernel.org/stable/c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-14027\nhttps://git.kernel.org/stable/c/9a3a2ae5efbbcaed37551218abed94e23c537157\nhttps://git.kernel.org/stable/c/d151b94967c8247005435b63fc60f8f4baa320da\n",
   "aliases": "CVE-2024-14027\nGHSA-h9jc-64qv-h9cg\n",
   "assigner": "Linux",
   "epss": 0.01,
@@ -24,13 +24,27 @@
       },
       "product_version": "patch: 6.13"
     },
+    {
+      "id": "7bf22de6-b246-320a-ae18-cf3483659b37",
+      "product": {
+        "name": "Linux"
+      },
+      "product_version": "patch: 6.6.133"
+    },
     {
       "id": "7c5b039a-75e7-3691-97f1-ce5892d035c1",
       "product": {
         "name": "Linux"
       },
       "product_version": "patch: 6.12.77"
     },
+    {
+      "id": "83678d73-fca3-3a50-ba26-764a79430b61",
+      "product": {
+        "name": "Linux"
+      },
+      "product_version": "patch: 6.6.131"
+    },
     {
       "id": "890f4be3-db4a-3273-b84e-ff4bbcba12d0",
       "product": {
@@ -52,13 +66,27 @@
       },
       "product_version": "c03185f4a23e7f89d84c9981091770e876e64480"
     },
+    {
+      "id": "9526fd79-a7bb-37fc-89e2-d4a5541e585c",
+      "product": {
+        "name": "Linux"
+      },
+      "product_version": "c03185f4a23e7f89d84c9981091770e876e64480 <9a3a2ae5efbbcaed37551218abed94e23c537157"
+    },
     {
       "id": "9b4d37f3-a4b4-3c5a-bec1-f4a827909f3d",
       "product": {
         "name": "Linux"
       },
       "product_version": "8d5863cb33aa424fc27115ee945ad6b96ae2facb"
     },
+    {
+      "id": "c22c6809-1f2b-3593-99a9-7f395045c98e",
+      "product": {
+        "name": "Linux"
+      },
+      "product_version": "c03185f4a23e7f89d84c9981091770e876e64480 <5a1e865e51063d6c56f673ec8ad4b6604321b455"
+    },
     {
       "id": "c588aa3a-d972-3a0a-bd62-2b4dbfe3395e",
       "product": {

advisories/2026/04/EUVD-2024-55535.json

@@ -0,0 +1,31 @@
+{
+  "id": "EUVD-2024-55535",
+  "enisaUuid": "cc753fa8-e271-3202-bd66-2edff3ab8187",
+  "description": "Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.",
+  "datePublished": "Apr 6, 2026, 6:33:04 PM",
+  "dateUpdated": "Apr 6, 2026, 6:33:04 PM",
+  "baseScore": 8.5,
+  "baseScoreVersion": "4.0",
+  "baseScoreVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
+  "references": "https://www.iru.com/blog/twitch-privileged-helper\nhttps://help.twitch.tv/s/topic/0TO3a000000kZfYGAU/twitch-studio\nhttps://help.twitch.tv/s/article/recommended-software-for-broadcasting\nhttps://www.vulncheck.com/advisories/twitch-studio-launcherhelper-xpc-missing-authorization-to-root-file-write\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-14032\n",
+  "aliases": "CVE-2024-14032\nGHSA-pp7p-6p72-cqxg\n",
+  "assigner": "VulnCheck",
+  "epss": 0.0,
+  "enisaIdProduct": [
+    {
+      "id": "6af3c53f-fef8-30e6-8533-56286117bbe7",
+      "product": {
+        "name": "Twitch Studio"
+      },
+      "product_version": "0 \u22640.114.8"
+    }
+  ],
+  "enisaIdVendor": [
+    {
+      "id": "9ce7de5a-6b09-3bdf-b13f-0df77d528f01",
+      "vendor": {
+        "name": "Twitch"
+      }
+    }
+  ]
+}