The lack of a CVE does not imply the lack of a security vulnerability.