--- a/xml/en/security_advisories.xml
+++ b/xml/en/security_advisories.xml
@@ -26,6 +26,7 @@ Patches are signed using one of the
 
 <item name="Excessive memory usage in HTTP/2"
       severity="low"
+      advisory="http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html"
       cve="2018-16843"
       good="1.15.6+, 1.14.1+"
       vulnerable="1.9.5-1.15.5">
@@ -33,6 +34,7 @@ Patches are signed using one of the
 
 <item name="Excessive CPU usage in HTTP/2"
       severity="low"
+      advisory="http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html"
       cve="2018-16844"
       good="1.15.6+, 1.14.1+"
       vulnerable="1.9.5-1.15.5">
@@ -40,6 +42,7 @@ Patches are signed using one of the
 
 <item name="Memory disclosure in the ngx_http_mp4_module"
       severity="medium"
+      advisory="http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html"
       cve="2018-16845"
       good="1.15.6+, 1.14.1+"
       vulnerable="1.1.3-1.15.5, 1.0.7-1.0.15">