diff --git a/gems/crass/GHSA-pq4g-8rxf-4g29.yml b/gems/crass/GHSA-pq4g-8rxf-4g29.yml
index a34e68f097..98b423b385 100644
--- a/gems/crass/GHSA-pq4g-8rxf-4g29.yml
+++ b/gems/crass/GHSA-pq4g-8rxf-4g29.yml
@@ -1,5 +1,6 @@
 ---
 gem: crass
+cve: 2026-116695
 ghsa: pq4g-8rxf-4g29
 url: https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29
 title: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
@@ -32,11 +33,15 @@ patched_versions:
   - ">= 1.0.8"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-116695
     - https://rubygems.org/gems/crass/versions/1.0.8
     - https://github.com/rgrove/crass/blob/v1.0.8/HISTORY.md#108-2026-10-21
     - https://github.com/rgrove/crass/compare/v1.0.7...v1.0.8
+    - https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34
     - https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url
+    - https://advisories.gitlab.com/gem/crass/CVE-2026-116695
+    - https://osv.dev/vulnerability/GHSA-pq4g-8rxf-4g29
     - https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29
+    - https://github.com/advisories/GHSA-pq4g-8rxf-4g29
 notes: |
-  - No CVE in GHSA URL.
   - cvss_v4 from GHSA URL.
diff --git a/gems/rubyntlm/GHSA-cx24-f932-rr55.yml b/gems/rubyntlm/GHSA-cx24-f932-rr55.yml
new file mode 100644
index 0000000000..e433f51b9a
--- /dev/null
+++ b/gems/rubyntlm/GHSA-cx24-f932-rr55.yml
@@ -0,0 +1,38 @@
+---
+gem: rubyntlm
+ghsa: cx24-f932-rr55
+url: https://github.com/WinRb/rubyntlm/security/advisories/GHSA-cx24-f932-rr55
+title: NTLMv2 authentication bypass - Type3#password? ignores its
+  password argument and verifies every message against the
+  empty password
+date: 2026-09-09
+description: |
+  Type3#password? ignores its password argument on the NTLMv2 path
+  and verifies the message against a blank password instead.
+
+  An application using password? to check NTLMv2 credentials will
+  accept any client that sends an empty password for a username it
+  knows, and will reject that account's real password. Knowing a
+  valid username is enough to authenticate as that user.
+
+  ## Impact
+
+  Authentication bypass (CWE-303). An application verifying NTLMv2
+  credentials with Type3#password? can be authenticated to by anyone
+  who knows a valid username. The application doesn't have to misuse
+  the API — password? is public, documented, and the only server-side
+  check the gem offers.
+cvss_v4: 9.3
+unaffected_versions:
+  - "< 0.5.0"
+patched_versions:
+  - ">= 0.6.6"
+related:
+  url:
+    - https://rubygems.org/gems/rubyntlm/versions/0.6.6
+    - https://github.com/WinRb/rubyntlm/releases/tag/v0.6.6
+    - https://github.com/winrb/rubyntlm/blob/main/CHANGELOG.md#066-2026-09-09
+    - https://github.com/WinRb/rubyntlm/security/advisories/GHSA-cx24-f932-rr55
+notes: |
+  - No CVE in GHSA URL.
+  - cvss_v4 from GHSA URL.