Correct the CVE reference