Fix links to CVEs.