CVEs affecting projects tracked on Release Alert, from NVD & OSV.
GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.