Threats affecting pkg:bitnami/gitlab

CVE-2026-126853 is a high-severity vulnerability in Google Chrome's Skia component prior to version 157.0.8103.78. It involves an uninitialized resource that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. This vulnerability was fixed in Chrome version 157.0.8103.78.

A type confusion vulnerability in the V8 engine of Google Chrome prior to version 157.0.8103.78 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. This issue has been assigned a high severity by Chromium security. The vulnerability is fixed in Chrome version 157.0.8103.78.

A use-after-free vulnerability exists in the Passwords component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker, via social engineering and a crafted HTML page, to execute arbitrary code outside the browser sandbox. The issue has been fixed in version 157.0.8103.78.

An information leak vulnerability exists in the core of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to leak cross-origin data by using a crafted HTML page. The vulnerability has been assigned a high severity by Chromium security. A fix is available in version 157.0.8103.78.

A use-after-free vulnerability in the BrowserTag component of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. This vulnerability has been assigned high severity by Chromium security.

A buffer overflow vulnerability exists in the Skia component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has been assigned a high severity by Chromium security. A fix is available in Chrome version 157.0.8103.78.

CVE-2026-126870 is a high-severity vulnerability in Google Chrome prior to version 157.0.8103.78. It involves an uninitialized resource in the ANGLE component, which could allow a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability has been fixed in Chrome version 157.0.8103.78.

A use-after-free vulnerability exists in the Animation component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The issue has been fixed in version 157.0.8103.78.

A use-after-free vulnerability exists in the Frames component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The issue has been fixed in Chrome version 157.0.8103.78.

A vulnerability in Google Chrome prior to version 157.0.8103.78 allowed remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages leveraging social engineering. This issue relates to link following in the FileSystem component and has been assigned a high severity rating by Chromium security.

An off-by-one error in the V8 engine of Google Chrome prior to version 157.0.8103.78 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has been assigned high severity by Chromium security. The issue is fixed in Chrome version 157.0.8103.78.

A use-after-free vulnerability in the V8 JavaScript engine of Google Chrome prior to version 157.0.8103.78 allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has been assigned high severity by Chromium security. A fix is available in Chrome version 157.0.8103.78.

A use-after-free vulnerability in the Accessibility component of Google Chrome prior to version 157.0.8103.78 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This vulnerability has been classified as critical by Chromium security. The issue is fixed in Chrome version 157.0.8103.78.

A use-after-free vulnerability exists in the Skia component of Google Chrome on Android versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The vulnerability is rated critical by Chromium security.

A use-after-free vulnerability exists in the Layout component of Google Chrome prior to version 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The issue is rated critical by Chromium security.

A use-after-free vulnerability exists in the CSS component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The issue is classified as critical and has been fixed in version 157.0.8103.78.

A use-after-free vulnerability exists in the ServiceWorker component of Google Chrome versions prior to 157.0.8103.78. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The issue is rated critical by Chromium security.

Two denial of service vulnerabilities have been identified in the Qt software toolkit's qt6-qtbase package. One issue involves an excessively large HTTP Cache-Control header (CVE-2026-76151), and the other involves crafted XML parsing in QXmlStreamReader (CVE-2026-16762). These vulnerabilities can cause application crashes or resource exhaustion. Red Hat has issued an important security advisory with updates for affected Red Hat Enterprise Linux 10.2 Extended Update Support versions to address these issues.

Two security vulnerabilities have been identified in the nginx web and proxy server, specifically in the ngx_http_core_module. One is a heap-based buffer overflow triggered via alias with rewrite referencing $request_filename (CVE-2026-15176). The other is an unspecified vulnerability in the same module (CVE-2026-97205). Red Hat has issued a security advisory and released updates for Red Hat Enterprise Linux 10.2 Extended Update Support and related products to address these issues.

Multiple security vulnerabilities have been identified in the perl-CGI module used in Red Hat Enterprise Linux 10. These include a denial of service via unenforced request and upload limits, arbitrary file write through unsanitized upload filenames, and a security feature bypass via untainted request parameters. Red Hat has issued an important security update addressing these issues.