Source profile

rapid7.com

Evidence-bounded context

A field appears only when the current profile revision carries supporting evidence. Missing context stays visibly unknown.

Source classes: Not yet evidenced
Ownership: Not yet evidenced
Funding ties: Not yet evidenced
Declared affiliations: Not yet evidenced
Geographic base: Not yet evidenced
Methodology: Not yet evidenced

Current clusters

security2 distinct publishers

CVE-2026-52806 turns a Gogs branch name into command execution as the git user

Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.

Publishers:rapid7.comrunzero.com

Reality

Evidence84
Adoption