Issues with no CVE number

[Ville Skyttä]

Are security issues that don't have a CVE number tracked somewhere?
Some issues may not have it by the time they're disclosed and I guess
there are ones that for whatever reason don't have and aren't going to
get one.  If they're tracked in the usual audit/* files, what's the
preferred format for them?

By the way, if more help is needed, feel free to add me (scop) rights to
commit to the fe[45] files.