CVEs affecting projects tracked on Release Alert, from NVD & OSV.
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.