gpodder has an indirect dependency on libplist (pulled by libgpod), which has known security vulnerabilities.