move CVE tests after walk_href to have all channels synced