CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.