CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.