diff --git a/vulns/CVE-2025-38464.yml b/vulns/CVE-2025-38464.yml
new file mode 100644
index 0000000..f0f9f58
--- /dev/null
+++ b/vulns/CVE-2025-38464.yml
@@ -0,0 +1,8 @@
+reachability: Local
+memory_corruption: true
+bug_class: UaF
+impact: LPE, DoS
+privileges_required: false
+notes: Can be triggered by unprivileged user through namespaces
+author: Oracle Corporation
+version: v0.1
diff --git a/vulns/CVE-2025-38724.yml b/vulns/CVE-2025-38724.yml
new file mode 100644
index 0000000..e584183
--- /dev/null
+++ b/vulns/CVE-2025-38724.yml
@@ -0,0 +1,8 @@
+reachability: remote
+memory_corruption: true
+bug_class: UAF
+impact: LPE or RCE
+privileges_required: false
+notes: use-after-free in the NFSv4 client id confirmation code.
+author: Oracle Corporation
+version: v0.1
diff --git a/vulns/CVE-2025-39946.yml b/vulns/CVE-2025-39946.yml
new file mode 100644
index 0000000..1a68553
--- /dev/null
+++ b/vulns/CVE-2025-39946.yml
@@ -0,0 +1,12 @@
+reachability: Remote
+memory_corruption: true
+bug_class: Buffer Overflow
+impact: LPE
+privileges_required: false
+notes: |-
+  An unprivileged user can create a TCP connection (loopback or network
+  namespace) and enable kTLS RX through setsockopt() If kTLS is enabled for
+  inbound connections, then an unprivileged remote attacker can trigger the OOW
+  kCTF entry exp422
+author: Oracle Corporation
+version: v0.1
diff --git a/vulns/CVE-2025-39973.yml b/vulns/CVE-2025-39973.yml
new file mode 100644
index 0000000..915d352
--- /dev/null
+++ b/vulns/CVE-2025-39973.yml
@@ -0,0 +1,8 @@
+reachability: VM
+memory_corruption: true
+bug_class: Buffer Overflow
+impact: DoS, information leak, VM escape
+privileges_required: false
+notes: No host privileges required IF a VF is exposed to the VM
+author: Oracle Corporation
+version: v0.1
diff --git a/vulns/CVE-2025-39977.yml b/vulns/CVE-2025-39977.yml
new file mode 100644
index 0000000..3f14476
--- /dev/null
+++ b/vulns/CVE-2025-39977.yml
@@ -0,0 +1,8 @@
+reachability: Local
+memory_corruption: true
+bug_class: UaF
+impact: LPE, Info Leak
+privileges_required: false
+notes: ""
+author: Oracle Corporation
+version: v0.1