Might be a dumb question but is there a mapping from CVE to GHSA or vice versa? If so, then where is it listed/described?

Edit: answered my own question - each GHSA in the repo has an `aliases` field and it seems that contains CVE; neat.

Thanks for sharing!