[api] support new CVE-YYYY-NNNN* syntax as specified by mitre.org

http://cve.mitre.org/cve/identifiers/syntaxchange.html