Threats affecting pkg:bitnami/gitlab

CVE-2026-126161 is a high-severity denial of service vulnerability in Fortinet FortiMail versions 7.4.0 through 7.4.6, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows a remote unauthenticated attacker to cause resource exhaustion by sending repeated unauthenticated POST requests, leading to service disruption.

CVE-2026-126162 is a high-severity vulnerability in Fortinet FortiMail versions 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. It involves an XML injection (blind XPath injection) flaw that could allow a remote unauthenticated attacker to execute unauthorized code or commands by sending a specially crafted request. An official fix is available for this issue.

CVE-2026-126160 is an improper authentication vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes by sending crafted quarantine release requests. The vulnerability has a high severity with a CVSS score of 8.2. An official fix is available from the vendor.

CVE-2026-126159 is an authorization bypass vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an unauthenticated attacker to release or delete quarantined email messages from arbitrary mailboxes by sending a specially crafted quarantine release request. This flaw affects the integrity of quarantined messages but does not impact confidentiality or availability.

CVE-2026-126147 is a critical path traversal vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated attacker to execute unauthorized code or commands by sending crafted requests. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction. An official fix is available from the vendor.

CVE-2026-126156 is a critical improper access control vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an unauthenticated remote attacker to bypass authorization via a user-controlled key and take over an arbitrary IBE recipient account by sending crafted HTTP requests. The vulnerability has a CVSS score of 9.1, indicating high impact on confidentiality and integrity. An official fix is available from the vendor.

CVE-2026-126152 is a high-severity vulnerability in Fortinet FortiMail versions 7.0.0 through 8.0.1. It allows an authenticated remote attacker to bypass authorization controls via user-controlled keys, enabling deletion of arbitrary directories as root and unauthorized access or deletion of other users' calendar and mailbox data across tenant domains through crafted HTTP requests to webmail and administrative interfaces.

CVE-2026-126151 is a vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It involves an incorrect implementation of the authentication algorithm that may allow an unauthenticated remote attacker to perform an account takeover via a crafted request. The vulnerability has a high severity score of 7.5 and has an official fix available.

CVE-2026-126154 is a high-severity denial of service vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It involves an out-of-bounds write triggered by a specially crafted HTTP request that can cause the service to crash. The vulnerability affects unauthenticated remote attackers and does not impact confidentiality or integrity.

CVE-2026-126153 is a path traversal vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated attacker to execute unauthorized commands by sending crafted requests that bypass directory restrictions. The vulnerability has a high severity rating with a CVSS score of 7.5. An official fix is available from Fortinet.

CVE-2026-126158 is an OS command injection vulnerability in Fortinet FortiMail versions 8.0.0 through 8.0.1. It allows an authenticated administrator to execute unauthorized commands as root via specially crafted HTTP requests. The vulnerability has a high severity with a CVSS score of 7.2. An official fix is available to address this issue.

CVE-2026-126155 is a critical vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It involves incorrect authorization that allows an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient. This enables the attacker to read or send encrypted mail by crafting specific HTTP requests.

CVE-2026-126157 is an improper authentication vulnerability in Fortinet FortiMail versions 7.0.0 through 8.0.1. It allows an unauthenticated attacker to gain access to other users' secure email accounts by sending crafted HTTP requests. The vulnerability affects multiple FortiMail release lines and has a critical severity rating with a CVSS score of 9.1. An official fix is available from Fortinet.

CVE-2026-126149 is an integer overflow or wraparound vulnerability in Fortinet FortiMail versions 7.0.0 through 8.0.1. This flaw may allow a remote unauthenticated attacker to crash the FortiMail daemon, causing a denial of service condition. The vulnerability affects multiple FortiMail release lines including 7.0, 7.2, 7.4, 7.6, and 8.0 versions within specified ranges.

CVE-2026-126150 is a critical vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.7, 7.6.0 through 7.6.5, and 8.0.0. It involves a weak password recovery mechanism that allows an unauthenticated attacker to reset the password of any IBE webmail user by sending specially crafted HTTP requests, resulting in account takeover. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity. An official fix is available from Fortinet to address this issue.

CVE-2026-126148 is a critical vulnerability in Fortinet FortiMail versions 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. It involves improper neutralization of special elements in OS commands, allowing unauthenticated attackers to execute unauthorized code or commands via crafted HA join-request packets. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. An official fix is available from Fortinet.

CVE-2026-126146 is a high-severity vulnerability in Fortinet FortiMail and FortiRecorder products that allows an authenticated privileged attacker to execute unauthorized code or commands. The flaw arises from improper neutralization of special elements in OS commands, specifically via crafted archive account configurations. Affected versions include multiple releases from FortiMail 7.2.0 through 8.0.1 and FortiRecorder 7.0.0 through 7.6.0. An official fix is available for this vulnerability.

CVE-2026-126144 is an OS command injection vulnerability affecting multiple versions of Fortinet FortiMail, FortiRecorder, and FortiVoice products. An authenticated attacker can exploit this flaw by sending specially crafted HTTP requests to execute unauthorized code or commands on the affected systems. The vulnerability impacts confidentiality, integrity, and availability of the affected products. A patch is available from Fortinet to address this issue.

CVE-2026-126145 is a high-severity vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It involves improper neutralization of special elements in OS commands, allowing an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root. This vulnerability has an official fix available.

An improper access control vulnerability in Devolutions Server versions 2026.3.13.0 and earlier allows an authenticated user with view-only permission on a shared entry to retrieve its password in clear text via a linked credential entry in their private vault. This issue is fixed in version 2026.3.14.