Product Security, CVEs, and Transparency