Add CVE-IDs to changelog