suse-add-cves utility takes a series of patches either as arguments or
one per line on stdin with --from_stdin (-f) option and updates CVE
number metadata in the patches. It needs upstream vulnerability repo
that can be cloned with: suse-add-cves -i -v /path. Existing repo is
accessed via via -v option or better via VULNS_GIT environment
variable. The vulnerability repo is kept up-to-date automatically and
is never older than 15 minutes.