https://vulnerability.circl.lu/sightings/feed 2026-08-26T16:50:46.960916+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c1f608f1-2a7b-4165-bcc9-6caa499268e5/export 2026-08-26T16:50:46.985784+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "c1f608f1-2a7b-4165-bcc9-6caa499268e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevato-sfruttamento-di-vulnerabilita-in-gitea", "content": "", "creation_timestamp": "2026-08-26T16:45:02.528731Z"} 2026-08-26T16:45:02.528731+00:00 https://vulnerability.circl.lu/sighting/66011543-fab4-4144-8aac-3bd5995dd236/export 2026-08-26T16:50:46.987812+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "66011543-fab4-4144-8aac-3bd5995dd236", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mtypi7dnfn2s", "content": "CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner\n\n", "creation_timestamp": "2026-08-26T16:03:32.370290Z"} 2026-08-26T16:03:32.370290+00:00 https://vulnerability.circl.lu/sighting/ff54409e-5174-491b-9cac-b1d235d634e6/export 2026-08-26T16:50:46.988791+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ff54409e-5174-491b-9cac-b1d235d634e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://t.me/pphm_HackerNews/2869", "content": "\ud83d\udd34 Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea.\n\nThe vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea OS user.", "creation_timestamp": "2026-08-26T16:00:04.382870Z"} 2026-08-26T16:00:04.382870+00:00 https://vulnerability.circl.lu/sighting/aaffa34c-2f1c-413b-83ea-92e0a5206252/export 2026-08-26T16:50:46.988895+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "aaffa34c-2f1c-413b-83ea-92e0a5206252", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtyomwmzjk24", "content": "\ud83e\udd16 CVE-2026-60004: critical code injection in Gitea allows pre-auth shell command execution via open registration. Actively exploited; CISA KEV added. Fixed in 1.27.1.\nhttps://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks/", "creation_timestamp": "2026-08-26T15:48:16.928748Z"} 2026-08-26T15:48:16.928748+00:00 https://vulnerability.circl.lu/sighting/c35fb9c8-b08f-4053-81b5-c2f3c9f4c8fc/export 2026-08-26T16:50:46.988969+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c35fb9c8-b08f-4053-81b5-c2f3c9f4c8fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60004", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mtyiuyssdi2j", "content": "Gitea RCE under active exploitation: CVE-2026-60004 turns a signup form into shell access.\nSelf-hosted Gitea often sits next to build and OT networks. Patch now.\n#ThreatIntel #ICS #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitea-diffpatch-rce-cve-2026-60004-exploited-2026", "creation_timestamp": "2026-08-26T14:05:26.017243Z"} 2026-08-26T14:05:26.017243+00:00 https://vulnerability.circl.lu/sighting/3b6ba592-d3db-41f3-8729-522d3d89502a/export 2026-08-26T16:50:46.989048+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3b6ba592-d3db-41f3-8729-522d3d89502a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "exploited", "source": "https://t.me/information_security_channel/55803", "content": "CISA Warns of Exploited Gitea Vulnerability\nhttps://www.securityweek.com/cisa-warns-of-exploited-gitea-vulnerability/\n\nCVE-2026-60004 is a remote code execution vulnerability patched by Gitea developers in late July with the release of version 1.27.1.\nThe post CISA Warns of Exploited Gitea Vulnerability (https://www.securityweek.com/cisa-warns-of-exploited-gitea-vulnerability/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-08-26T14:00:05.691388Z"} 2026-08-26T14:00:05.691388+00:00 https://vulnerability.circl.lu/sighting/9297caa5-d019-40ad-b5a9-afde210b41e3/export 2026-08-26T16:50:46.989117+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9297caa5-d019-40ad-b5a9-afde210b41e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mtygrbfewf24", "content": "\ud83d\udea8 CISA KEV ALERT: A critical RCE flaw in Gitea (CVE-2026-60004, CVSS 9.8) is actively exploited. Attackers can gain RCE on self-hosted Git servers. Patch to version 1.27.1 or later NOW. #Gitea #RCE #CISA #KEV #CVE202660004\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-26T13:27:32.975098Z"} 2026-08-26T13:27:32.975098+00:00 https://vulnerability.circl.lu/sighting/3d0a70db-69b2-4240-b2a5-dce275c8f410/export 2026-08-26T16:50:46.989186+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3d0a70db-69b2-4240-b2a5-dce275c8f410", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60004", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117162038172183890", "content": "\ud83d\udcf0 CISA Warns of Actively Exploited Gitea RCE Flaw (CVE-2026-60004)\n\ud83d\udea8 CISA KEV ALERT: A critical RCE flaw in Gitea (CVE-2026-60004, CVSS 9.8) is actively exploited. Attackers can gain RCE on self-hosted Git servers. Patch to version 1.27.1 or later NOW. #Gitea #RCE #CISA #KEV #CVE202660004\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-gitea-rce-flaw-cve-2026-60004/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-08-26T13:27:20.337830Z"} 2026-08-26T13:27:20.337830+00:00 https://vulnerability.circl.lu/sighting/498a2b41-d891-41fa-91d2-7e5e49f7bbea/export 2026-08-26T16:50:46.989256+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "498a2b41-d891-41fa-91d2-7e5e49f7bbea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60004", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mtyfb6k5nk2q", "content": "\ud83d\udc1b VULNERABILITIES Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) \u2014 Help Net Security\nhttps://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/ #PatchManagement #Vulnerability #CVE", "creation_timestamp": "2026-08-26T13:00:38.966074Z"} 2026-08-26T13:00:38.966074+00:00 https://vulnerability.circl.lu/sighting/840f9f34-fa89-4898-a402-f9fe84c5a5e7/export 2026-08-26T16:50:46.989323+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "840f9f34-fa89-4898-a402-f9fe84c5a5e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://t.me/HackerNewscyber/3371", "content": "\u2708\ufe0f \u0647\u0634\u062f\u0627\u0631 CISA \u062f\u0631\u0628\u0627\u0631\u0647 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u062f\u0631 Gitea\n\n\ud83c\udfa4\u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 (CISA) \u0646\u0633\u0628\u062a \u0628\u0647 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0641\u0639\u0627\u0644 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-60004 \u062f\u0631 \u067e\u0644\u062a\u0641\u0631\u0645 \u0645\u062a\u0646\u200c\u0628\u0627\u0632 \u00ab\u06af\u06cc\u062a\u06cc\u0627\u00bb (Gitea) \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f.\n\n\ud83c\udfa5\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0646\u0648\u0639 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0627\u0633\u062a \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0628\u0647 \u06cc\u06a9 \u0645\u062e\u0632\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0648\u0634\u062a\u0646 \u062f\u0627\u0631\u0646\u062f\u060c \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0631\u0627\u0628\u0637 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc diffpatch\u060c \u06a9\u062f\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635 \u062f\u0631 \u0646\u0633\u062e\u0647 1.27.1 \u06af\u06cc\u062a\u06cc\u0627 \u0628\u0631\u0637\u0631\u0641 \u0634\u062f\u0647 \u0648 CISA \u0622\u0646 \u0631\u0627 \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647 \u0648 \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631\u06af\u0631\u0641\u062a\u0647 \u0627\u0636\u0627\u0641\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\u2708\ufe0f @HackerNewsCyber", "creation_timestamp": "2026-08-26T13:00:03.350570Z"} 2026-08-26T13:00:03.350570+00:00