In short, they found vulnerabilities and each have been assigned CVEs.