Added CVE reference to changelog