Merge pull request #1129 from connorshea/fix-cvss-score

Fix CVSS v3 and v4 parsing/output in GitHub advisory sync.

The changes were straightforward so I think it is safe for me to merge this PR.

Author: jasnow

gems/action_text-trix/GHSA-53p3-c7vp-4mcc.yml

@@ -34,6 +34,7 @@ description: |
 
   The XSS vulnerability was responsibly reported by Hackerone
   researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
+cvss_v4: 2.1
 patched_versions:
   - ">= 2.1.18"
 related:

gems/actionmailer/CVE-2024-47889.yml

@@ -34,6 +34,7 @@ description: |
   ##Credits
 
   Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
+cvss_v4: 6.6
 unaffected_versions:
   - "< 3.0.0"
 patched_versions:

gems/actionpack/CVE-2024-47887.yml

@@ -36,6 +36,7 @@ description: |
   ## Credits
 
   Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
+cvss_v4: 6.6
 unaffected_versions:
   - "< 4.0.0"
 patched_versions:

gems/actionpack/CVE-2026-33167.yml

@@ -15,6 +15,7 @@ description: |
 
   ### Releases
   The fixed releases are available at the normal locations.
+cvss_v4: 1.3
 unaffected_versions:
   - "< 8.1.0"
 patched_versions:

gems/actiontext/CVE-2024-32464.yml

@@ -46,6 +46,7 @@ description: |
 
   Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting this!
 cvss_v3: 6.1
+cvss_v4: 5.1
 unaffected_versions:
   - "< 7.1.0"
 patched_versions:

gems/actiontext/CVE-2024-47888.yml

@@ -35,6 +35,7 @@ description: |
   ## Credits
 
   Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
+cvss_v4: 6.6
 unaffected_versions:
   - "< 6.0.0"
 patched_versions:

gems/actionview/CVE-2026-33168.yml

@@ -15,6 +15,7 @@ description: |
 
   ### Releases
   The fixed releases are available at the normal locations.
+cvss_v4: 2.3
 patched_versions:
   - "~> 7.2.3, >= 7.2.3.1"
   - "~> 8.0.4, >= 8.0.4.1"

gems/activejob/GHSA-mpwp-4h2m-765c.yml

@@ -15,6 +15,7 @@ description: |
     We also fixed an Active Job bug that allowed String
     arguments to be deserialized as if they were Global IDs,
     an object injection security vulnerability.
+cvss_v4: 6.6
 patched_versions:
   - ">= 4.2.0.beta2"
 related:

gems/activerecord-jdbc-adapter/GHSA-5qw5-wf2q-f538.yml

@@ -14,6 +14,7 @@ description: |
   using it in SQL queries. This may allow a remote attacker to inject or
   manipulate SQL queries in the back-end database, allowing for the
   manipulation or disclosure of arbitrary data.
+cvss_v4: 8.8
 unaffected_versions:
   - "< 1.2.6"
 patched_versions:

gems/activerecord/CVE-2013-3221.yml

@@ -21,6 +21,7 @@ description: |
     But "Indeed the vector is completely fixed as of Rails 4.2 almost
     two years after the original advisory."
 cvss_v2: 6.4
+cvss_v4: 9.3
 patched_versions:
   - ">= 4.2.0"
 related: