added CVEs in NEWS