CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Open-AudIT before 2.2 has CSV Injection.