Add CVE-id's to ChangeLog.