CVEs affecting projects tracked on Release Alert, from NVD & OSV.
TCPDF before 6.7.4 mishandles calls that use HTML syntax.