CVEs affecting projects tracked on Release Alert, from NVD & OSV.
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.