CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.