CVEs affecting projects tracked on Release Alert, from NVD & OSV.
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c.