Threats affecting pkg:bitnami/gitlab

An out-of-bounds read vulnerability exists in the Skia component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. The issue has been fixed in Chrome version 157.0.8103.78.

An incorrect authorization vulnerability in the SiteIsolation feature of Google Chrome on Android versions prior to 157.0.8103.78 allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. This vulnerability has been assigned a high severity by Chromium security. A fix is available in version 157.0.8103.78.

A use-after-free vulnerability exists in the MediaStream component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The issue has been fixed in Chrome version 157.0.8103.78.

A use-after-free vulnerability exists in the PDF component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The issue has been fixed in version 157.0.8103.78.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to potentially execute arbitrary code within the browser sandbox via a crafted HTML page. This vulnerability is classified with high severity by Chromium security.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has been fixed in Chrome version 157.0.8103.78.

A missing authorization vulnerability in the ImageCapture component of Google Chrome prior to version 157.0.8103.78 allows a remote attacker with control over the renderer process to bypass the web origin policy via a crafted HTML page. This issue has been fixed in Chrome version 157.0.8103.78.

An out of bounds write vulnerability in the V8 engine of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has been assigned high severity by Chromium security. A fix is available in Chrome version 157.0.8103.78.

A use of uninitialized variable vulnerability exists in the Skia component of Google Chrome on Android versions prior to 157.0.8103.78. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The issue has been fixed in version 157.0.8103.78.

A race condition vulnerability exists in the Extensions component of Google Chrome on Mac systems prior to version 157.0.8103.78. This flaw allows a remote attacker who has compromised the renderer process to obtain sensitive information by leveraging crafted network traffic. The issue has been fixed in Chrome version 157.0.8103.78.

An information leak vulnerability exists in the Skia component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker who has compromised the renderer process to leak cross-origin data by using a crafted HTML page. The vulnerability has been assigned a high severity by Chromium security. A fix is available in Chrome version 157.0.8103.78.

CVE-2026-126848 is a high-severity vulnerability in Google Chrome's Skia component prior to version 157.0.8103.78. It involves an uninitialized resource that allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. The issue was fixed in Chrome version 157.0.8103.78.

An out-of-bounds write vulnerability exists in the Network component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The issue has been assigned a high severity by Chromium security.

A use-after-free vulnerability exists in the Core component of Google Chrome on Windows versions prior to 157.0.8103.78. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has been assigned a high severity by Chromium security. A fix is available in version 157.0.8103.78.

An out-of-bounds read vulnerability exists in the Skia component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to obtain cross-origin data by crafting a malicious HTML page. The issue has been assigned a high severity by Chromium security.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 157.0.8103.78 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. This flaw has been fixed in Chrome version 157.0.8103.78.

A use-after-free vulnerability exists in the MediaStream component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The issue has been fixed in version 157.0.8103.78.

An incorrect authorization vulnerability in the Layout component of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to obtain cross-origin data via a crafted HTML page. This issue has been fixed in version 157.0.8103.78.

A type confusion vulnerability in the Turbolev component of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has been assigned high severity by Chromium security. The issue is fixed in Chrome version 157.0.8103.78.

A buffer overflow vulnerability exists in the Turbolev component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The issue has been fixed in Chrome version 157.0.8103.78.