diff --git a/vim.changes b/vim.changes
index ad5cc6d..5ef1b2b 100644
--- a/vim.changes
+++ b/vim.changes
@@ -39,7 +39,8 @@ Wed Jun  5 12:27:42 UTC 2019 - Ismail Dönmez <idonmez@suse.com>
   * Code and data in tests can be hard to read.
   * ":vert options" does not make a vertical split.
   * Design for popup window support needs more details.
-  * Source command doesn't check for the sandbox.
+  * Source command doesn't check for the sandbox. CVE-2019-12735
+    boo#1137443
   * Using expressions in a modeline is unsafe.
   * can set 'modelineexpr' in modeline.
   * Modeline test fails with python but without pythonhome.