G
Vendor security profile
GitroomHQ
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs5
Critical2
CISA KEV0
Public exploit0
Patch rate%100
Avg. CVSS7.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
2
1
CVE KEV
CVE severity distribution
5toplam CVE
Critical2 (40%)
High1 (20%)
Medium2 (40%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%0
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
5.3
CVE-2026-107761
Channel tokens and organization API key exposed in API responses
G
Patch verified
7.1
CVE-2026-94455
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
G
Patch verifiedEPSS %0
9.1
CVE-2026-94456
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
G
Patch verifiedEPSS %1
9.8
CVE-2026-19264
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
G
Patch verifiedEPSS %1
6.5
CVE-2026-19127
Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
G
Patch verifiedEPSS %0