update CVE IDs