Threats affecting pkg:bitnami/gitlab

A vulnerability in Google Chrome extensions prior to version 157.0.8103.78 allows a remote attacker to execute arbitrary code inside the sandbox by leveraging social engineering and a crafted extension. The flaw is due to incorrect authorization in the extensions component.

A missing authorization vulnerability in the V8 JavaScript engine of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to bypass the web origin policy using a crafted HTML page. This vulnerability is classified with high severity by Chromium security.

A use-after-free vulnerability exists in the Browser component of Google Chrome on Windows versions prior to 157.0.8103.78. This flaw could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A use-after-free vulnerability in HTML processing in Google Chrome versions prior to 157.0.8103.78 could allow a remote attacker to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A vulnerability in the Layout component of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to bypass authorization controls and obtain cross-origin data via a crafted HTML page. This issue is classified with high severity by the Chromium security team.

A use-after-free vulnerability in the Accessibility component of Google Chrome versions prior to 157.0.8103.78 allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. This vulnerability is classified with high severity by Chromium security.

A type confusion vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 157.0.8103.78 could allow a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The issue is classified with high severity by Chromium security.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome versions prior to 157.0.8103.78 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. The issue is classified with high severity by the Chromium security team.

A vulnerability in the Skia graphics library used by Google Chrome prior to version 157.0.8103.78 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. This issue is due to an uninitialized resource in Skia.

An out-of-bounds read vulnerability exists in the Skia component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A use-after-free vulnerability exists in ANGLE component of Google Chrome versions prior to 157.0.8103.78. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A use-after-free vulnerability exists in the Skia component of Google Chrome on Android versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability is classified as critical by Chromium security.

A vulnerability in Skia within Google Chrome versions prior to 157.0.8103.78 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. This issue is classified with high severity by Chromium security.

A vulnerability in the Skia graphics library used by Google Chrome versions prior to 157.0.8103.78 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. This issue is classified with high severity by Chromium security.

An out-of-bounds write vulnerability exists in the Network component of Google Chrome versions prior to 157.0.8103.78. This flaw could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a specially crafted HTML page. The issue is classified with high severity by Chromium security.

An incorrect authorization vulnerability in the SiteIsolation feature of Google Chrome on Android versions prior to 157.0.8103.78 allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. The issue is classified with high security severity by Chromium.

A type confusion vulnerability exists in the Turbolev component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A use-after-free vulnerability exists in the MediaStream component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a specially crafted HTML page. The vulnerability is classified with high severity by the Chromium security team.

A vulnerability in Google Chrome prior to version 157.0.8103.78 involves an uninitialized GPU resource that allows a remote attacker, who has already compromised the renderer process, to potentially read memory outside the sandbox via a crafted HTML page. This flaw is classified with high severity by Chromium security.

A security vulnerability (CVE-2026-126757) exists in Moonshot AI Kimi Code up to version 2.5.2 affecting the Web UI component. The flaw is an open redirect caused by manipulation of the 'kimi_origin' argument in the isOriginAllowed function within a JavaScript file. This vulnerability can be exploited remotely and public exploit details have been disclosed. The vendor has not responded to the disclosure. The CVSS score is 4.3, indicating medium severity.