Metasploit

Critical Zero-Day in Gogs Lets Authenticated Users Run Remote Code

Rapid7’s May 28–29 disclosure shows an automatable exploit and indicators of compromise while Gogs has not released a patch leaving many internet-facing installs exposed.