NEWS.md: fix markdown syntax; mention more bug fixs; list cves