CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.