diff --git a/python39.changes b/python39.changes
index 43bc971..4e045e0 100644
--- a/python39.changes
+++ b/python39.changes
@@ -18,10 +18,10 @@ Wed Dec  4 19:51:41 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
       consistently use the mapped IPv4 address value for deciding
       properties. Properties which have their behavior fixed are
       is_multicast, is_reserved, is_link_local, is_global, and
-      is_unspecified.
+      is_unspecified (bsc#1233307, CVE-2024-11168).
   - Library
     - gh-124651: Properly quote template strings in venv
-      activation scripts.
+      activation scripts (bsc#1232241, CVE-2024-9287).
     - gh-103848: Add checks to ensure that [ bracketed ] hosts
       found by urllib.parse.urlsplit() are of IPv6 or IPvFuture
       format.