Modularity and needed changes on CVE handling side?