Arguments either way. Generic "security vulnerabilities addressed" in release notes is a nice balance.