For an exisiting research project, we're focusing on the /server directory. Based on what I can tell, these are the CVEs that lack CVEs but also have a known fix that touches the /server directory:
CVE-2009-1891
CVE-2011-3368
CVE-2011-3607
CVE-2012-4929
CVE-2014-0117
CVE-2014-0226
CVE-2014-3523
CVE-2015-0253
CVE-2015-3183
CVE-2017-3167
CVE-2017-9798