CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Vanilla 2.6.x before 2.6.4 allows remote code execution.