CVEs affecting projects tracked on Release Alert, from NVD & OSV.
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.