corrections and clarifications

Author: jodygarnett

_posts/2025-06-10-cve-disclosure.md

@@ -10,7 +10,7 @@ categories:
 The GeoServer community has readied the following CVE vulnerabilities for public disclosure.
 
 * [CVE-2025-30220](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc) XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service (High)  
-  Fixed: 2.27.1 | 2.26.3 | 2.25.6
+  Fixed: 2.27.1 | 2.26.3 | 2.25.7
 
 * [CVE-2025-30145](https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf) Denial-of-service (DoS) Vulnerability in Jiffle process (High)  
   Fixed: 2.27.0 | 2.26.3 | 2.25.7
@@ -30,6 +30,8 @@ The GeoServer community has readied the following CVE vulnerabilities for public
 * [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost (High)  
   [CVE-2021-40822](https://github.com/geoserver/geoserver/security/advisories/GHSA-68cf-j696-wvv9) SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx (High)  
   Fixed: 2.25.2 | 2.24.4
+  
+  This duplication is due to CVE-2021-40822 being generated prior to our use of CVE records.
 
 
 The following release announcements have been updated: