Time for a hill to die on: it makes no logical sense to say "two unknown cves in citrix". The whole definition of a cve is as a constant public identifier of a specific vulnerability. If you cannot give me a cve number there is no new cve - just an exploit with no published information. Its like saying there are two new words in the official English dictionary, but no dictionary is allowed to document them.