CVEs affecting projects tracked on Release Alert, from NVD & OSV.
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.