CVE-2021-22204
Chain: regex in EXIF processor code does not correctly determine where a string ends (CWE-625), enabling eval injection (CWE-95), as exploited in the wild per CISA KEV.
CVE-2020-8218
"Code injection" in VPN product, as exploited in the wild per CISA KEV.