diff --git a/vulns/CVE-2025-40274.yml b/vulns/CVE-2025-40274.yml
new file mode 100644
index 0000000..d21941c
--- /dev/null
+++ b/vulns/CVE-2025-40274.yml
@@ -0,0 +1,11 @@
+reachability: Local
+memory_corruption: true
+bug_class: UaF
+impact: LPE
+privileges_required: false
+notes: |2-
+   Use after free in the KVM guest_memfd unbind path leading to kernel memory
+  corruption and eventually LPE. Reachable from unprivileged user inside guest
+  KVM
+author: Oracle Corporation
+version: v0.1
diff --git a/vulns/CVE-2026-31431.yml b/vulns/CVE-2026-31431.yml
new file mode 100644
index 0000000..d8d6e65
--- /dev/null
+++ b/vulns/CVE-2026-31431.yml
@@ -0,0 +1,10 @@
+reachability: Local
+memory_corruption: true
+bug_class: OOB write
+impact: LPE
+privileges_required: false
+notes: |2-
+   Exploitable via AF_ALG recvmsg without capabilities - direct from userland
+  syscalls.
+author: Oracle Corporation
+version: v0.1