Skip to content
Sign in

Gitea product

Several products

Alert
No CISA KEV deadline is open. CISA last added a Several products CVE on 25 Aug.

Tracked since 29 Jul · latest article 7 Oct · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

1High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date1

Several products CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Several products CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-60004Gitea25 AugPassed 28 Aug7
Vendor CSV of 1 entry for GiteaAll 1 vendor entry, including other products.

Patch cadence and exploit odds

How often CISA adds Several products CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20261
Q4 20260

Fix listed

5 of 5 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-60004: 97.8th percentile, in CISA KEVCVE-2026-59774: 98.1th percentileCVE-2026-96404: 47.6th percentileCVE-2026-103059: 33th percentileCVE-2026-101027: 14th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-5977498.1
CVE-2026-6000497.8
CVE-2026-9640447.6
CVE-2026-10305933
CVE-2026-10102714

Coverage9 articles · all time

The latest 9 articles naming Several products, in the shared story grammar.

Full timeline
Quiet for 3 weekslast report 7 Oct9 articles4 outlets

9 articles from 4 outlets since 29 Jul. Quiet since 7 Oct.

Now29 Jul2530369137 OctFirst reportSecurityOnline · 29 Jul, 10:11CISA alert25 Aug, 22:43 · official
  • Wed 29 Jul, 10:11 UTC. SecurityOnline, first report. CVE-2026-60004: Gitea RCE lets attackers run code via Git hook. Cites a CVE in CISA KEV.
  • Tue 4 Aug, 09:31 UTC. SecurityOnline. Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution.
  • Tue 25 Aug, 22:43 UTC. CISA, its first report on the story. CISA Flags Gitea Code Injection Flaw in KEV Catalogue. Cites a CVE in CISA KEV.
  • Wed 26 Aug, 05:50 UTC. SecurityWeek, its first report on the story. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28. Cites a CVE in CISA KEV.
  • Wed 26 Aug, 09:45 UTC. Security Affairs, its first report on the story. CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List. Cites a CVE in CISA KEV.
  • Wed 26 Aug, 14:26 UTC. CISA. CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 02:31 UTC. SecurityOnline. Weekly CVE Report: 11 Exploited Flaws Added to KEV. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 04:41 UTC. SecurityOnline. Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:11 UTC. SecurityOnline. Gitea fixes 27 flaws, including SSH authentication bypass and SSRF attacks.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Wed 29 JulDay 01
    1. CVE-2026-60004: Gitea RCE lets attackers run code via Git hook10:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 6 days

    Tue 4 AugDay 61
    1. Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution09:31 · SecurityOnline · Picked up again

  3. Quiet for 3 weeks

    Tue 25 AugDay 271
    1. CISA Flags Gitea Code Injection Flaw in KEV Catalogue22:43 · CISA · official · CISA alert · Picked up again · Known exploited CVE
  4. Wed 26 AugDay 283
    1. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 2805:50 · SecurityWeek · Known exploited CVE
    2. CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List09:45 · Security Affairs · Known exploited CVE
    3. CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching14:26 · CISA · official · Known exploited CVE

  5. Quiet for 5 days

    Mon 31 AugDay 331
    1. Weekly CVE Report: 11 Exploited Flaws Added to KEV02:31 · SecurityOnline · Picked up again · Known exploited CVE

  6. Quiet for 2 weeks

    Tue 15 SepDay 481
    1. Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data04:41 · SecurityOnline · Picked up again · Known exploited CVE

  7. Quiet for 3 weeks

    Wed 7 OctDay 701
    1. Gitea fixes 27 flaws, including SSH authentication bypass and SSRF attacks15:11 · SecurityOnline · Picked up again

All CVEs in coverage5

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-60004Exploited

    Gitea Code Injection Vulnerability

    9.8Critical24% EPSS · 7 articles
  • CVE-2026-59774

    Gitea Org-mode file disclosure and code execution

    Not scored28% EPSS · 1 article
  • CVE-2026-96404

    Gitea vulnerability

    8.1High0.6% EPSS · 1 article
  • CVE-2026-103059

    Gitea vulnerability

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-101027

    Gitea vulnerability

    7.7High0.2% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in