document cve id's for posterity