Do we really need CVE numbers assigned for all of these? More or less every application out there is vulnerable to some form of timing attack