diff --git a/thrift/TODO b/thrift/TODO
index 131d035a6a..014b8a45c7 100644
--- a/thrift/TODO
+++ b/thrift/TODO
@@ -1,2 +1,2 @@
 - This package has known vulnerabilities, please investigate and fix if possible:
-   CVE-2016-5397
+   CVE-2016-5397, CVE-2018-1320, CVE-2018-11798