CVEs affecting projects tracked on Release Alert, from NVD & OSV.
In Gitea before 1.21.2, an anonymous user can visit a private user's project.