CVEs affecting projects tracked on Release Alert, from NVD & OSV.
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.