CVEs affecting projects tracked on Release Alert, from NVD & OSV.
GitLab EE 10.1 through 12.7.2 allows Information Disclosure.