diff --git a/VERSION.txt b/VERSION.txt
index 2e02f1ed0aa..1aac3c85595 100644
--- a/VERSION.txt
+++ b/VERSION.txt
@@ -6,7 +6,7 @@ jetty-10.0.17 - 09 October 2023
  + 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
    start of Jetty
  + 10547 Cannot customize Executor on WebSocketClient
- + 10679 Review HTTP/2 rate control
+ + 10679 Review HTTP/2 rate control (CVE-2023-44487)
 
 jetty-10.0.16 - 25 August 2023
  + 6140 Report total number of keys in SelectorManager
@@ -29,6 +29,7 @@ jetty-10.0.16 - 25 August 2023
    common location
  + 9682 RetainableByteBuffer buffer release bug in WebSocket
  + 9685 Jetty doesn't set the date header on error responses
+ + 9749 Correct HPACK Integer Overflow (CVE-2023-36478)
  + 9720 Http2Session.streamIdleTimeout should permit being disabled from
    AbstractHTTP2ServerConnectionFactory
  + 9772 Improve Quiche certificates deployment