CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.