CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.