add another applicable cve ID to the changelog,