This is really interesting - and extremely ambitious. Having played with the CVE database, I'd caution you that it was surprisingly difficult (for me) to parse. The content is mildly unstructured, so that would be one of the first things I would look to figure out before building the retrieval system for the affected code.