CVEs affecting projects tracked on Release Alert, from NVD & OSV.
tcpdump 4.9.0 has a heap-based buffer over-read in the pimv1_print function in print-pim.c.