CVEs affecting projects tracked on Release Alert, from NVD & OSV.
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.