ctrlINT What the industry said about every indicator, with the quote

CVE-2026-60004Vulnerability

Gitea Code Injection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 6 independent sources · first reported by Risky Business News · last reported

Last reported 4 days ago

CISA KEVAdded 25 Aug 2026
Fix due 28 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS24.0%
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

7 reports, newest first · the exact sentence from each

  1. “On August 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004 to their Known Exploited Vulnerabilities (KEV) Database.”

    Canadian Centre for Cyber SecurityGovernment
    Gitea security advisory (AV26-845) - Update 1

  2. “CVE-2026-60004”

    SOCRadarVendor
    Top RCE Vulnerabilities

  3. “CVE-2026-60004”

    Recorded FutureVendor
    September 2026 CVE Landscape

  4. “Gitea critical RCE vulnerability CVE-2026-60004 exploited in the wild”

    CERT-EUGovernment
    Cyber Brief 26-09 - August 2026

  5. “Gitea - CVE-2026-60004”

    GreyNoiseVendor
    Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

  6. “CVE-2026-60004”

    Recorded FutureVendor
    August 2026 CVE Landscape

  7. “[CISA // CVE-2026-60004]”

    Risky Business NewsNews
    Risky Bulletin: Two TeamPCP members arrested in Australia

Indicators reported together

named in the same reports

Also named with it: CVE-2026-33824, CVE-2022-0847, CVE-2026-63030, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-64849, CVE-2026-39987, CVE-2026-60137, CVE-2021-29441, CVE-2026-81578, CVE-2026-82078, CVE-2026-76461, CVE-2023-54391, CVE-2026-87902, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-93616, CVE-2026-94127

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-60004 here?
No account needed. We do not store your IP address.