CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.