CVEs affecting projects tracked on Release Alert, from NVD & OSV.
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.