CVEs affecting projects tracked on Release Alert, from NVD & OSV.
GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.