CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.