Add the missing CVE number to the release notes.