Skip to content
Sign in

Gitea product

Open Source Git Server

Alert
No Open Source Git Server CVE is in the CISA KEV catalogue.

Tracked since 28 May · latest article 26 Aug · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No Open Source Git Server CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds Open Source Git Server CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a Open Source Git Server CVE to KEV.

Fix listed

4 of 4 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-20896: 86.1th percentileCVE-2026-27771: 72.2th percentileCVE-2026-58443: 47.4th percentileCVE-2026-22874: 40th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-2089686.1
CVE-2026-2777172.2
CVE-2026-5844347.4
CVE-2026-2287440

Coverage7 articles · all time

The latest 7 articles naming Open Source Git Server, in the shared story grammar.

Full timeline
Quiet for 9 weekslast report 26 Aug7 articles4 outlets

7 articles from 4 outlets since 28 May. Quiet since 26 Aug.

Now28 May91420262611162225 AugFirst reportSecurityWeek · 28 May, 11:40Exploited CVESecurityWeek · 26 Aug
  • Thu 28 May, 11:40 UTC. SecurityWeek, first report. Unauthenticated Gitea flaw leaks private images (CVE-2026-27771).
  • Thu 25 Jun, 02:21 UTC. SecurityOnline, its first report on the story. Gitea auth flaw lets attackers hijack admin accounts via SSRF.
  • Mon 6 Jul, 17:41 UTC. The Hacker News, its first report on the story. Attackers Exploit New Gitea Docker Bug CVE-2026-20896.
  • Tue 7 Jul, 17:31 UTC. SecurityWeek. Critical Gitea Flaw Under Active Exploitation, Researchers Warn.
  • Tue 7 Jul, 22:31 UTC. Security Affairs, its first report on the story. CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth.
  • Mon 20 Jul, 16:11 UTC. SecurityOnline. CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed.
  • Wed 26 Aug, 05:50 UTC. SecurityWeek. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Thu 28 MayDay 01
    1. Unauthenticated Gitea flaw leaks private images (CVE-2026-27771)11:40 · SecurityWeek · First report

  2. Quiet for 4 weeks

    Thu 25 JunDay 281
    1. Gitea auth flaw lets attackers hijack admin accounts via SSRF02:21 · SecurityOnline · Picked up again

  3. Quiet for 12 days

    Mon 6 JulDay 391
    1. Attackers Exploit New Gitea Docker Bug CVE-2026-2089617:41 · The Hacker News · Picked up again
  4. Tue 7 JulDay 402
    1. Critical Gitea Flaw Under Active Exploitation, Researchers Warn17:31 · SecurityWeek
    2. CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth22:31 · Security Affairs

  5. Quiet for 13 days

    Mon 20 JulDay 531
    1. CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed16:11 · SecurityOnline · Picked up again

  6. Quiet for 5 weeks

    Wed 26 AugDay 901
    1. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 2805:50 · SecurityWeek · Exploited CVE · Picked up again · Known exploited CVE

All CVEs in coverage4

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-20896

    Gitea Open Source Git Server vulnerability

    9.8Critical2.8% EPSS · 5 articles
  • CVE-2026-27771

    Gitea Composer package source links use insufficient permission checks

    8.2High1.4% EPSS · 1 article
  • CVE-2026-58443

    Public-only repository tokens can update private PR head branches

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-22874

    Gitea webhook and migration allow-list filtering permits SSRF

    9.6Critical0.5% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in