Add three new CVEs for older modules

These CVEs are not live yet, but have been confirmed by cve-assign. The CVEs were requested by Chris McNab.