web/security: add CVEs for 2.1.4

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>