Playing devil's advocate-- do you suppose developers who don't mention security vulnerabilities and/or fixes in their changelogs are deliberately doing so to avoid publicly acknowledging their product isn't "perfect"? Or perhaps are being told to do so by their supervisors?