CVEs affecting projects tracked on Release Alert, from NVD & OSV.
markdown-it before 4.1.0 does not block data: URLs.