CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Parameters are not validated or sanitized, and are later used in various internal operations.