CVEs affecting projects tracked on Release Alert, from NVD & OSV.
XMLReader.php in PHPOffice Common before 0.2.9 allows XXE.