CVEs affecting projects tracked on Release Alert, from NVD & OSV.
In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.