Mallory.Ai Critical Vulnerabilities in Gogs and Jinjava Require Immediate Patching
Article Content
- •Gogs has multiple critical vulnerabilities allowing remote code execution and file manipulation.
- •Jinjava's vulnerability enables arbitrary Java code execution through a sandbox escape.
- •Immediate patching is recommended to mitigate risks of exploitation and data theft.
Multiple critical vulnerabilities affecting Gogs and Jinjava have been disclosed, with severe impacts including remote code execution (RCE) and unauthorized file access. Gogs vulnerabilities include CVE-2025-64111 (RCE), CVE-2025-64175 (2FA bypass), and CVE-2026-24135 (path traversal), all affecting versions prior to 0.14.3. Jinjava's CVE-2026-25526 allows arbitrary Java code execution through a sandbox escape. The vulnerabilities can lead to full host takeover and theft of sensitive data. Administrators are urged to upgrade to patched versions immediately. Active exploitation has been reported for other vulnerabilities in related systems. The Centre for Cybersecurity Belgium emphasizes the urgency of patching to prevent potential breaches.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track Gogs and CVE-2025-62878 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed… 
Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises…