looks handy though we have ultimately not had good times with CVEs, which is why we chose to pivot around "advisories" instead