Threats affecting pkg:bitnami/gitlab

Multiple security vulnerabilities have been identified in the perl-CGI module used in Red Hat Enterprise Linux 9.8 Extended Update Support. These include a denial of service via unenforced request and upload limits, arbitrary file write through unsanitized upload filenames, and a security feature bypass via untainted request parameters. Red Hat has issued an important security advisory with updates to address these issues.

CVE-2026-114556 is a path traversal vulnerability in MailEnable version 10.59 that allows remote attackers to create arbitrary files without authentication. The flaw arises from improper validation of user-supplied paths in the Save method, potentially enabling further exploitation such as code execution with SYSTEM privileges.

CVE-2026-114558 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5. It involves an out-of-bounds write during the parsing of OPJU files, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction.

CVE-2026-114568 is a heap-based buffer overflow vulnerability in OriginLab Origin Viewer version 9.9.5. It occurs during the parsing of OPJ files due to improper validation of user-supplied data length before copying to a heap buffer. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution with high impact on confidentiality, integrity, and availability.

CVE-2026-114567 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGWU file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to memory corruption and potential code execution in the context of the current process.

CVE-2026-114566 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving improper restriction of operations within the bounds of a memory buffer during OGM file parsing. This memory corruption flaw allows remote attackers to execute arbitrary code by convincing a user to open a malicious file or visit a malicious page. Exploitation requires user interaction.

CVE-2026-114565 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGG file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, leading to memory corruption and potential code execution in the context of the current process.

CVE-2026-114564 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGG file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to a write beyond the allocated memory structure.

CVE-2026-114563 is a stack-based buffer overflow vulnerability in OriginLab Origin Viewer version 9.9.5. It occurs during the parsing of OGWU files due to improper validation of user-supplied data length before copying to a stack buffer. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution in the context of the current process.

CVE-2026-114562 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5. It involves an out-of-bounds write during the parsing of OGWU files, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction.

CVE-2026-114561 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OPJU file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, leading to memory corruption and potential code execution within the context of the current process.

CVE-2026-114560 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OPJ file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution within the context of the current process.

CVE-2026-114559 is a high-severity vulnerability in OriginLab Origin Viewer version 9.9.5 involving an out-of-bounds write during OGG file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, leading to a write beyond allocated memory.

CVE-2026-114569 is a heap-based buffer overflow vulnerability in OriginLab Origin Viewer version 9.9.5. It occurs during the parsing of OGWU files due to improper validation of user-supplied data length before copying to a heap buffer. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution with high impact on confidentiality, integrity, and availability.

CVE-2026-122044 is an authentication bypass vulnerability in the Philips Hue Bridge Pro. It allows network-adjacent attackers to bypass authentication without requiring user interaction. The flaw exists in the HTTP service listening on TCP port 443 due to a failure to apply a protection mechanism.

CVE-2026-118632 is a high-severity SQL Injection vulnerability in the Philips Hue Bridge Pro device. It allows network-adjacent attackers to execute arbitrary code with root privileges by exploiting improper validation of user input in the device's HTTP service on TCP port 443. Although authentication is required, the authentication mechanism can be bypassed, enabling exploitation. This vulnerability can lead to full compromise of affected devices.

CVE-2026-118631 is an argument injection vulnerability in the Philips Hue Bridge Pro's factory data service. This flaw allows local attackers with low-privileged code execution within a container to modify files by exploiting improper validation of user-supplied input used in system calls. The service listens on TCP port 5001 by default. The vulnerability impacts the integrity of files accessible by the service account but does not affect confidentiality or availability.

CVE-2026-121753 is a use-after-free vulnerability in Ashlar-Vellum Cobalt XE file parsing that allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The flaw arises from operations on an object without verifying its existence, leading to potential code execution in the context of the current process. The affected version is 1204.207. The vulnerability has a high severity with a CVSS score of 7.8.

CVE-2026-121752 is a heap-based buffer overflow vulnerability in Ashlar-Vellum Cobalt version 1204.207. It occurs during the parsing of LI files due to improper validation of user-supplied data length before copying to a heap buffer. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution with high impact on confidentiality, integrity, and availability.