CVEs affecting projects tracked on Release Alert, from NVD & OSV.
In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.