diff --git a/ethical-disclosures-and-CVEs/README.md b/ethical-disclosures-and-CVEs/README.md
index e69de29..adc952e 100644
--- a/ethical-disclosures-and-CVEs/README.md
+++ b/ethical-disclosures-and-CVEs/README.md
@@ -0,0 +1,8 @@
+Original disclosure for client-side attack:
+https://seclists.org/oss-sec/2019/q4/122
+
+Disclosure follow-up (server-side attack):
+https://seclists.org/oss-sec/2020/q3/116
+
+Bugzilla:
+https://bugzilla.redhat.com/show_bug.cgi?id=1774905
\ No newline at end of file