Add CVE number to ChangeLog