Unprotected large blob endpoint in GitLab allows Denial of Service
Improper XPath validation allows modified SAML response to bypass 2FA requirement
A Discord webhook integration may cause DoS
Unbounded Kubernetes cluster tokens may lead to DoS
Unvalidated notes position may lead to Denial of Service
Hidden/masked variables may get exposed in the UI
Two-factor authentication requirement bypass
View full email addresses that should be partially obscured
Branch name confusion in confidential MRs
Unauthorized access to job data via a GraphQL query