Threats affecting pkg:bitnami/gitlab

An out-of-bounds write vulnerability exists in Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2. This flaw may allow a remote unauthenticated attacker to cause a denial of service by sending a specially crafted HTTP request.

CVE-2026-126148 is a critical OS command injection vulnerability in Fortinet FortiMail versions 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. It allows an unauthenticated attacker to execute arbitrary commands by sending specially crafted HA join-request packets. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in Fortinet FortiClientEMS versions 7.2 (all versions), 7.4.0 through 7.4.1, and 7.4.3 through 7.4.7 allows an authenticated local attacker with administrative privileges to execute commands with unnecessary elevated privileges, potentially gaining root shell access via CLI commands.

An improper authentication vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow an unauthenticated attacker to gain access to other users' secure email accounts by sending crafted HTTP requests.

CVE-2026-126152 is an authorization bypass vulnerability affecting Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an authenticated remote attacker to delete arbitrary directories as root or access and delete other users' calendar and mailbox data across tenant domains via crafted HTTP requests to the webmail and administrative interfaces.

An OS command injection vulnerability exists in Fortinet FortiMail versions 8.0.0 through 8.0.1. This flaw allows an authenticated administrator to execute unauthorized commands as root via specially crafted HTTP requests. The vulnerability is rated high severity with a CVSS score of 7.2.

An open redirect vulnerability exists in Fortinet FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. This flaw allows an unauthenticated attacker to craft HTTP requests that redirect users to untrusted external sites. The vulnerability has a medium severity rating with a CVSS score of 6.1.

Dell Display and Peripheral Manager (DDPM Windows) versions prior to 2.4.0.17 contain a Time-of-check Time-of-use (TOCTOU) condition vulnerability. This flaw allows a low privileged local attacker to potentially execute arbitrary code. The vulnerability has a high severity rating with a CVSS score of 7. No patch or remediation details are provided in the available data.

An incorrect authorization vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail by sending crafted HTTP requests.

CVE-2026-126159 is an authorization bypass vulnerability in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an unauthenticated attacker to release or delete quarantined email messages for arbitrary mailboxes by sending a crafted quarantine release request. The vulnerability has a high severity with a CVSS score of 7.5.

CVE-2026-126785 is a critical vulnerability in rmalright TR-VISION HOME version 2.0.5. It involves incorrect default permissions in the IOCTL Handler component, specifically in the sub_11504 function of the WFanManager.sys library. The vulnerability requires local access to exploit and can lead to significant security risks due to improper permission settings. The vendor has not responded to disclosure attempts, and no patch or remediation information is currently available.

CVE-2026-125785 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetEngine versions prior to 3.9.1.1. It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects versions from initial releases up to 3.9.1. The issue has been fixed in version 3.9.1.1.

CVE-2026-125786 is a medium severity vulnerability in ExpressTech's Quiz And Survey Master plugin (versions before 11.3.1). It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability has been fixed in version 11.3.1.

CVE-2026-125787 is a missing authorization vulnerability in the ExpressTech Quiz And Survey Master plugin (quiz-master-next) affecting versions before 11.3.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access or actions. The issue is fixed in version 11.3.1.

.NET 9.0 on Red Hat Enterprise Linux 10 has multiple security vulnerabilities including information disclosure, elevation of privilege, and denial of service affecting ASP.NET Core and .NET components. These issues are addressed in an update to SDK 9.0.124 and Runtime 9.0.23. The update is rated as important by Red Hat Product Security.

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 10. The update includes fixes for several security issues such as use-after-free, out-of-bounds read/write, denial of service, and memory leaks across various kernel subsystems including SCTP, MPTCP, SMB client, iSCSI, and others. The advisory recommends applying the update and rebooting the system to mitigate these issues.

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 10. The update includes fixes for several use-after-free issues, denial of service vulnerabilities, and validation errors across various kernel subsystems such as networking, cryptography, and device drivers. The advisory emphasizes the importance of applying the update and rebooting affected systems to mitigate these security risks.

A security vulnerability (CVE-2026-78030) was identified in the perl-DBI package used in Red Hat Enterprise Linux 8. The flaw involves loading arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in the DBD::DBM driver. This could allow an attacker to load unintended modules, potentially leading to security risks. Red Hat has issued a security update for perl-DBI version 1.641 to address this issue.