any commit identified as fixing a potential security issue gets a CVE assigned, even if it’s a minor one or has no known exploit path.

Seems much less severe than it sounds.