Small change to CVE notation fixes #186