I've now gone through and updated all the Critical, Important, and Medium Fedora tracker bugs for CVEs that were subject to the Fedora 20 expiration. I believe there were some others that also pitched in to help (thanks!).
I noticed quite a few of the trackers apply to rawhide which means there are still a lot of packages that aren't being maintained but rather just pushed into the next version without a thought. Not sure what the answer is to this but maybe that's something else we can figure out.
--Eric