CVEs affecting projects tracked on Release Alert, from NVD & OSV.
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.