CVEs affecting projects tracked on Release Alert, from NVD & OSV.
The referrer URL used by MFA required additional sanitizing, rather than being used directly.