Quite a few vulnerabilities don't have CVEs. You can find some of them in the Github Security Advisories.