CVE analysis