Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36755.json"