CVEs affecting projects tracked on Release Alert, from NVD & OSV.
J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.