CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.