If you find a vulnerability in cvelib, please report it privately to secalert@redhat.com.
In addition to the description of the vulnerability, if possible please include a short reproducer, a proposed severity rating (for example, see Red Hat's severity ratings), and other classifying metadata such as a CWE ID or a CVSS score.