Privilege Escalation via LFS Tokens Granting Unrestricted Repository Access
Cross project access of Security policy bot
Advanced search ReDOS in highlight for code results
Denial of Service via banzai pipeline
Denial of service using adoc files
ReDoS in RefMatcher when matching branch names using wildcards
Path encoding can cause the Web interface to not render diffs correctly
XSS while viewing raw XHTML files through API
Ambiguous tag name exploitation
Logs disclosings potentially sensitive data in query params
Password bypass on approvals using policy projects
ReDoS when parsing git push
Webhook deletion audit log can preserve auth credentials