CVEs affecting projects tracked on Release Alert, from NVD & OSV.
edx-platform before 2016-06-06 allows CSRF.