CVEs affecting projects tracked on Release Alert, from NVD & OSV.
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.