His site provides a list of CVEs.

Source: https://www.itnews.com.au/news/marvin-breathes-new-life-into-bleichenbachers-timing-oracle-attack-600636?utm_source=feed&utm_medium=rss&utm_campaign=iTnews+

In 2022 there was a significant increase in API-related CVEs, growing +78% from H1 to H2.

Source: https://www.helpnetsecurity.com/2023/03/08/api-threat-landscape/

Of the 30 Common Vulnerabilities and Exposures (CVEs) analyzed, three were exploited within hours of public disclosure and 63% were exploited within 12 weeks of the public disclosure.

Source: https://mid-east.info/2023-unit-42-attack-surface-threat-report-highlights-the-need-for-asm/