...and if the number of CVEs is less or unknown compared to the IPs, change Javafan's program slightly

$anz= @cves;
while (@ips) {
    say "IP address $_ gets CVE ", $cves[int(rand($anz))];
}
[download]

The shuffle isn't necessary in that case