responding to CVEs