CVEs affecting projects tracked on Release Alert, from NVD & OSV.
GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.