web/security: put CVE-2014-5271 in () for 1.2, as the encoder lacked alpha support back then
web/index: mention 2.3.3 and a few other releases