Mention CVE number in ChangeLog.