I could live with simplifying the proposal to just list CVE numbers and timestamps.