diff --git a/2024/12xxx/CVE-2024-12224.json b/2024/12xxx/CVE-2024-12224.json
index fa7afb51822..5a94af8cd25 100644
--- a/2024/12xxx/CVE-2024-12224.json
+++ b/2024/12xxx/CVE-2024-12224.json
@@ -1,18 +1,89 @@
 {
+    "data_version": "4.0",
     "data_type": "CVE",
     "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
         "ID": "CVE-2024-12224",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "ASSIGNER": "security@mozilla.org",
+        "STATE": "PUBLIC"
     },
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname."
             }
         ]
-    }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-1289",
+                        "cweId": "CWE-1289"
+                    }
+                ]
+            }
+        ]
+    },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "vendor_name": "servo",
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "rust-url",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_affected": "<",
+                                            "version_name": "0",
+                                            "version_value": "1.0.0"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    }
+                }
+            ]
+        }
+    },
+    "references": {
+        "reference_data": [
+            {
+                "url": "https://rustsec.org/advisories/RUSTSEC-2024-0421.html",
+                "refsource": "MISC",
+                "name": "https://rustsec.org/advisories/RUSTSEC-2024-0421.html"
+            },
+            {
+                "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1887898",
+                "refsource": "MISC",
+                "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1887898"
+            }
+        ]
+    },
+    "generator": {
+        "engine": "Vulnogram 0.2.0"
+    },
+    "source": {
+        "discovery": "UNKNOWN"
+    },
+    "configuration": [
+        {
+            "lang": "en",
+            "supportingMedia": [
+                {
+                    "base64": false,
+                    "type": "text/html",
+                    "value": "In applications using <code>idna</code> (but not in <code>idna</code> \nitself) this may be able to lead to privilege escalation when host name \ncomparison is part of a privilege check and the behavior is combined \nwith a client that resolves domains with such labels instead of treating\n them as errors that preclude DNS resolution / URL fetching and with the\n attacker managing to introduce a DNS entry (and TLS certificate) for an\n <code>xn--</code>-masked name that turns into the name of the target when processed by <code>idna</code> 0.5.0 or earlier.<br>"
+                }
+            ],
+            "value": "In applications using idna (but not in idna \nitself) this may be able to lead to privilege escalation when host name \ncomparison is part of a privilege check and the behavior is combined \nwith a client that resolves domains with such labels instead of treating\n them as errors that preclude DNS resolution / URL fetching and with the\n attacker managing to introduce a DNS entry (and TLS certificate) for an\n xn---masked name that turns into the name of the target when processed by idna 0.5.0 or earlier."
+        }
+    ]
 }
\ No newline at end of file
diff --git a/2025/48xxx/CVE-2025-48757.json b/2025/48xxx/CVE-2025-48757.json
index e796e2cce2a..e64a809143e 100644
--- a/2025/48xxx/CVE-2025-48757.json
+++ b/2025/48xxx/CVE-2025-48757.json
@@ -1,17 +1,76 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
-        "ID": "CVE-2025-48757",
         "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "ID": "CVE-2025-48757",
+        "STATE": "PUBLIC"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "n/a",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "n/a"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "n/a"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites."
+            }
+        ]
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "n/a"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "url": "https://docs.lovable.dev/changelog",
+                "refsource": "MISC",
+                "name": "https://docs.lovable.dev/changelog"
+            },
+            {
+                "refsource": "MISC",
+                "name": "https://mattpalmer.io/posts/CVE-2025-48757/",
+                "url": "https://mattpalmer.io/posts/CVE-2025-48757/"
+            },
+            {
+                "refsource": "MISC",
+                "name": "https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9",
+                "url": "https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9"
+            },
+            {
+                "refsource": "MISC",
+                "name": "https://x.com/danialasaria/status/1911862269996118272",
+                "url": "https://x.com/danialasaria/status/1911862269996118272"
             }
         ]
     }