Introduce version scope to define CVE affected versions