an insecure software will have multiple CVEs, not necessarily related to each other. Those 3 are probably not the only ones.