That's actually supported by the CVE program rules. Have at it if you find examples with security vulns.