Public Exploits Released for Three Gogs RCE Flaws, CVSS Up to 10

Gogs released version 0.14.3 to patch three critical RCE vulnerabilities (CVSS 9.4–10) that allow unauthenticated or low-privilege users to achieve remote code execution via organization name path traversal, branch/rebase argument injection, and symlink-based file writes; working proofs-of-concept are public, multiple instance types are exposed, and administrators should update immediately and disable open registration as a stopgap.