web/secrity: add CVEs for 3.3.4