The CVE- prefix is optional for URLs.