Browse CVEs

MEDIUM 5.5 CVE-2026-50135 Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat … Hugo 0.161.1+ Fix from $1,6002026-07-06 MEDIUM 6.8 CVE-2026-58404 Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and clo… Hugo 0.163.1+ Fix from $1,6002026-07-06 MEDIUM 6.5 CVE-2026-58403 Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outsi… Hugo 0.163.1+ Fix from $1,6002026-07-06 MEDIUM 5.4 CVE-2026-58402 Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string … Hugo 0.163.3+ Fix from $1,6002026-07-06 MEDIUM 6.1 CVE-2026-50133 Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (ty… Hugo 0.162.0+ Fix from $1,6002026-07-06 MEDIUM 5.8 CVE-2026-50134 Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did … Hugo 0.162.0+ Fix from $1,6002026-07-06 HIGH 8.1 CVE-2026-44301 Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, Tailwin… Hugo 0.161.0+ Fix from $1,9502026-05-12 MEDIUM 5.4 CVE-2026-35166 Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escap… Hugo 0.159.2+ Fix from $1,6002026-04-06 HIGH 8.5 CVE-2020-26284 Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc docu… Hugo 0.79.1+ Fix from $1,9502020-12-21