CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.