Merge branch '2.7' into 2.8
diff --git a/release-notes/VERSION b/release-notes/VERSION
index b52019b..73d786a 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -8,7 +8,11 @@
#1941: `TypeFactory.constructFromCanonical()` throws NPE for Unparameterized
generic canonical strings
(reported by ayushgp@github)
-#2032: Blacklist another serialization gadget (ibatis)
+#2032: CVE-2018-11307: Potential information exfiltration with default typing, serialization gadget from MyBatis
+ (reported by Guixiong Wu)
+#2052: CVE-2018-12022: Block polymorphic deserialization of types from Jodd-db library
+ (reported by Guixiong Wu)
+#2058: CVE-2018-12023: Block polymorphic deserialization of types from Oracle JDBC driver
(reported by Guixiong Wu)
2.8.11.1 (11-Feb-2018)