CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.