dev-util/Orange depends on dev-qt/qtwebkit:4 which is ancient and will never see any security updates. If there's no upstream fix available, it might be time to remove this package.
commit 3edc430fd685e096e151adb15c57f508c4dfdd2a Author: Amy Liffey <amynka@gentoo.org> Date: Wed Aug 2 13:56:17 2017 +0200 dev-util/Orange: remove old