Revert r452818, the vuxmlweb build does not like empty CVE IDs.

This should likely be tested for as part of "make validate".

Hat: clusteradm