CVE security fixes