CVEs affecting projects tracked on Release Alert, from NVD & OSV.
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.