CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Authenticated users were able to enumerate other users' names via the learning plans page.