diff --git a/ee/app/assets/javascripts/security_dashboard/components/project/project_vulnerability_report.vue b/ee/app/assets/javascripts/security_dashboard/components/project/project_vulnerability_report.vue
index 417468ee47f8c70daab52e7dbd57b3c99225b077..0fba7d5a33634ee59beddfed0324998fa1b8607c 100644
--- a/ee/app/assets/javascripts/security_dashboard/components/project/project_vulnerability_report.vue
+++ b/ee/app/assets/javascripts/security_dashboard/components/project/project_vulnerability_report.vue
@@ -1,5 +1,7 @@
 <script>
 import { difference } from 'lodash';
+import { GlAlert } from '@gitlab/ui';
+import { s__ } from '~/locale';
 import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 import { translateScannerNames } from '~/security_configuration/utils';
 import SecurityTrainingPromoBanner from 'ee/security_dashboard/components/project/security_training_promo_banner.vue';
@@ -9,6 +11,18 @@ import securityScannersQuery from '../../graphql/queries/project_security_scanne
 import ReportNotConfiguredProject from './report_not_configured_project.vue';
 import SecurityScannerAlert from './security_scanner_alert.vue';
 
+const VULNERABILITY_QUOTA = {
+  critical: s__(
+    'SecurityReports|This project is reaching the maximum number of vulnerabilities it can contain.',
+  ),
+  enforced: s__(
+    'SecurityReports|This project has reached the maximum number of vulnerabilities it can contain. New vulnerabilities will not be created.',
+  ),
+  full: s__(
+    "SecurityReports|This project has reached the maximum number of vulnerabilities it can contain and some of the vulnerabilities couldn't be ingested.",
+  ),
+};
+
 export default {
   components: {
     ReportNotConfiguredProject,
@@ -17,8 +31,16 @@ export default {
     ProjectPipelineStatus,
     VulnerabilityReportTabs,
     SecurityTrainingPromoBanner,
+    GlAlert,
   },
-  inject: ['fullPath', 'pipeline', 'sbomPipeline', 'hasVulnerabilities', 'hideThirdPartyOffers'],
+  inject: [
+    'fullPath',
+    'pipeline',
+    'sbomPipeline',
+    'hasVulnerabilities',
+    'hideThirdPartyOffers',
+    'vulnerabilityQuota',
+  ],
   data() {
     return {
       scannerAlertDismissed: false,
@@ -43,6 +65,9 @@ export default {
     },
   },
   computed: {
+    quotaWarning() {
+      return VULNERABILITY_QUOTA[this.vulnerabilityQuota];
+    },
     isReportConfigured() {
       // A report is configured when either a pipeline generated a security report, or when
       // vulnerabilities are added through the new vulnerability page or API. There are 3 cases:
@@ -100,6 +125,16 @@ export default {
       @dismiss="dismissScannerAlert"
     />
 
+    <gl-alert
+      v-if="quotaWarning"
+      title="Warning"
+      variant="warning"
+      class="gl-mt-5"
+      :dismissible="false"
+    >
+      {{ quotaWarning }}
+    </gl-alert>
+
     <security-training-promo-banner v-if="shouldShowPromoBanner" class="gl-mt-5" />
 
     <vulnerability-report-tabs>
diff --git a/ee/app/assets/javascripts/security_dashboard/vulnerability_report_init.js b/ee/app/assets/javascripts/security_dashboard/vulnerability_report_init.js
index 095f6b8f9d0b55c8d1cf5d7f26d5adf267975a65..53fd2f17775d260adac32204eaad20e71e5bc6e4 100644
--- a/ee/app/assets/javascripts/security_dashboard/vulnerability_report_init.js
+++ b/ee/app/assets/javascripts/security_dashboard/vulnerability_report_init.js
@@ -65,6 +65,9 @@ export default (el, dashboardType) => {
     newVulnerabilityPath,
     dismissalDescriptions,
     hideThirdPartyOffers,
+    vulnerabilityQuotaCritical,
+    vulnerabilityQuotaEnforced,
+    vulnerabilityQuotaFull,
   } = el.dataset;
 
   if (isUnavailable) {
@@ -78,6 +81,16 @@ export default (el, dashboardType) => {
     });
   }
 
+  let vulnerabilityQuota;
+
+  if (vulnerabilityQuotaFull !== 'false') {
+    vulnerabilityQuota = 'full';
+  } else if (vulnerabilityQuotaEnforced !== 'false') {
+    vulnerabilityQuota = 'enforced';
+  } else if (vulnerabilityQuotaCritical !== 'false') {
+    vulnerabilityQuota = 'critical';
+  }
+
   const provide = {
     dashboardType,
     noVulnerabilitiesSvgPath,
@@ -90,6 +103,7 @@ export default (el, dashboardType) => {
     vulnerabilitiesExportEndpoint,
     groupFullPath,
     projectFullPath,
+    vulnerabilityQuota,
     fullPath: projectFullPath || groupFullPath,
     canAdminVulnerability: parseBoolean(canAdminVulnerability),
     hasVulnerabilities: parseBoolean(hasVulnerabilities),
diff --git a/ee/spec/frontend/security_dashboard/components/project/project_vulnerability_report_spec.js b/ee/spec/frontend/security_dashboard/components/project/project_vulnerability_report_spec.js
index 54387facabb6f5daec05729634c1904be8b5cc53..9144c78d968f0800ff3e8451acd83e55ad9d3960 100644
--- a/ee/spec/frontend/security_dashboard/components/project/project_vulnerability_report_spec.js
+++ b/ee/spec/frontend/security_dashboard/components/project/project_vulnerability_report_spec.js
@@ -1,8 +1,7 @@
 import Vue, { nextTick } from 'vue';
-import { shallowMount } from '@vue/test-utils';
-
 import VueApollo from 'vue-apollo';
 import VueRouter from 'vue-router';
+import { GlAlert } from '@gitlab/ui';
 import SecurityTrainingPromoBanner from 'ee/security_dashboard/components/project/security_training_promo_banner.vue';
 import ProjectVulnerabilityReport from 'ee/security_dashboard/components/project/project_vulnerability_report.vue';
 import ReportNotConfiguredProject from 'ee/security_dashboard/components/project/report_not_configured_project.vue';
@@ -12,10 +11,11 @@ import ProjectPipelineStatus from 'ee/security_dashboard/components/shared/proje
 import SecurityScannerAlert from 'ee/security_dashboard/components/project/security_scanner_alert.vue';
 import securityScannersQuery from 'ee/security_dashboard/graphql/queries/project_security_scanners.query.graphql';
 import { DASHBOARD_TYPES } from 'ee/security_dashboard/store/constants';
-import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 import { useLocalStorageSpy } from 'helpers/local_storage_helper';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
+import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 import { SCANNER_NAMES_MAP } from '~/security_configuration/constants';
 
 Vue.use(VueApollo);
@@ -45,8 +45,9 @@ describe('Project vulnerability report app component', () => {
     hasVulnerabilities = true,
     securityScanners,
     hideThirdPartyOffers = false,
+    vulnerabilityQuota,
   } = {}) => {
-    wrapper = shallowMount(ProjectVulnerabilityReport, {
+    wrapper = shallowMountExtended(ProjectVulnerabilityReport, {
       router,
       apolloProvider: createMockApollo([
         [securityScannersQuery, securityScannersHandler(securityScanners)],
@@ -58,6 +59,7 @@ describe('Project vulnerability report app component', () => {
         hasVulnerabilities,
         dashboardType: DASHBOARD_TYPES.PROJECT,
         hideThirdPartyOffers,
+        vulnerabilityQuota,
       },
       stubs: {
         VulnerabilityReportTabs,
@@ -96,6 +98,29 @@ describe('Project vulnerability report app component', () => {
     );
   });
 
+  describe('quota warning', () => {
+    const findQuotaWarning = () => wrapper.findComponent(GlAlert);
+
+    it.each`
+      quotaStatus   | expectedMessage
+      ${'enforced'} | ${'This project has reached the maximum number of vulnerabilities it can contain. New vulnerabilities will not be created.'}
+      ${'critical'} | ${'This project is reaching the maximum number of vulnerabilities it can contain.'}
+      ${'full'}     | ${"This project has reached the maximum number of vulnerabilities it can contain and some of the vulnerabilities couldn't be ingested."}
+    `(
+      'displays a warning message when quota status is $quotaStatus',
+      ({ quotaStatus, expectedMessage }) => {
+        createWrapper({ vulnerabilityQuota: quotaStatus });
+        expect(findQuotaWarning().exists()).toBe(true);
+        expect(wrapper.findByText(expectedMessage).exists()).toBe(true);
+      },
+    );
+
+    it('displays no warning message when the vulnerability quota status is not provided', () => {
+      createWrapper({ vulnerabilityQuota: '' });
+      expect(findQuotaWarning().exists()).toBe(false);
+    });
+  });
+
   describe('project pipeline status component', () => {
     it('shows the component if there is a pipeline', () => {
       createWrapper();
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index b70923dd0c5e018d0f0a2ae40879bc0d47b915e5..a4853638b2d7c21ad16d455de2d55540ca4f2ac7 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -50641,6 +50641,15 @@ msgstr ""
 msgid "SecurityReports|These vulnerabilities were detected in external sources. They are not necessarily tied to your GitLab project. For example, running containers, URLs, and so on."
 msgstr ""
 
+msgid "SecurityReports|This project has reached the maximum number of vulnerabilities it can contain and some of the vulnerabilities couldn't be ingested."
+msgstr ""
+
+msgid "SecurityReports|This project has reached the maximum number of vulnerabilities it can contain. New vulnerabilities will not be created."
+msgstr ""
+
+msgid "SecurityReports|This project is reaching the maximum number of vulnerabilities it can contain."
+msgstr ""
+
 msgid "SecurityReports|This selection is required."
 msgstr ""