CVEs affecting projects tracked on Release Alert, from NVD & OSV.
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.