CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Shynet before 0.14.0 allows Host header injection in the password reset flow.