security: fix the CVE numbers