CVEs affecting projects tracked on Release Alert, from NVD & OSV.
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.