CVEs affecting projects tracked on Release Alert, from NVD & OSV.
JSON++ through 2016-06-15 has a buffer over-read in yyparse() in json.y.