Rust itself has CVEs. Which projects are you referring to?