Known vulnerabilities for a package (OSV.dev — aggregate of GHSA, PyPA, RustSec, Go and more) or a free-text CVE search (NVD), with severity and fixed versions