diff --git a/MozillaThunderbird.changes b/MozillaThunderbird.changes
index 55da034..179616b 100644
--- a/MozillaThunderbird.changes
+++ b/MozillaThunderbird.changes
@@ -8,8 +8,12 @@ Thu Sep  2 07:03:59 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>
   * Account setup did not use provider display name for setting up
     calendars
   * Various theme and UX fixes
-  MFSA 2021-XX (bsc#1190269)
-
+  MFSA 2021-41 (bsc#1190269)
+  * CVE-2021-38492 (bmo#1721107)
+    Navigating to `mk:` URL scheme could load Internet Explorer
+  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
+    bmo#1724107)
+    Memory safety bugs fixed in Thunderbird 91.1
 - (re-)added mozilla-silence-no-return-type.patch
 - add mozilla-bmo531915.patch to fix build for i586