note CVE numbers

CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a9d2887..132b2e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,8 +9,8 @@
 
 ## Security
 
-  - Fix bounds-check in processing OEM commands
-  - Fix bounds-check in dhcpv6 against MTU
+  - Fix bounds-check in processing OEM commands (CVE-2026-95507)
+  - Fix bounds-check in dhcpv6 against MTU (CVE-2026-95508)
 
 ### Fixed