web/security: Add CVEs for 2.5.4, 2.4.7, 2.1.7 and 1.2.12