Update with note about CVE reports