diff --git a/pcp/TODO b/pcp/TODO
new file mode 100644
index 0000000000..6039aea92d
--- /dev/null
+++ b/pcp/TODO
@@ -0,0 +1,3 @@
+This package has known vulnerabilities, please investigate and fix if possible:
+
+CVE-2019-3695, CVE-2019-3696