diff --git a/CHANGES.rst b/CHANGES.rst
index 5deb91e..2f4a594 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -14,12 +14,12 @@ Bugs fixed
* Fixed a bug where Unicode escapes in CSS were not properly decoded
before security checks. This prevents attackers from bypassing filters
- using escape sequences.
+ using escape sequences. (CVE-2026-28348)
* Fixed a security issue where ```` tags could be used for URL
hijacking attacks. The ```` tag is now automatically removed
whenever the ```` tag is removed (via ``page_structure=True``
or manual configuration), as ```` must be inside ````
- according to HTML specifications.
+ according to HTML specifications. (CVE-2026-28350)
0.4.3 (2025-10-02)
==================
@@ -58,7 +58,7 @@ Bugs fixed
within CSS comments. In certain contexts, such as within ``