https://x-stream.github.io/CVE-2022-41966.html (probably not affected because NO_REFERENCES is in use?)

https://x-stream.github.io/CVE-2022-40151.html

https://x-stream.github.io/changes.html#1.4.20

PS: Came here from Keycloak for which trivy reports issues.