Vulnerability index

Browse CVEs

9 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Hugo MEDIUM 5.5
CVE-2026-50135

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat …

Fix: 0.161.1+
Fix from $1,600 2026-07-06
Hugo MEDIUM 6.8
CVE-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and clo…

Fix: 0.163.1+
Fix from $1,600 2026-07-06
Hugo MEDIUM 6.5
CVE-2026-58403

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outsi…

Fix: 0.163.1+
Fix from $1,600 2026-07-06
Hugo MEDIUM 5.4
CVE-2026-58402

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string …

Fix: 0.163.3+
Fix from $1,600 2026-07-06
Hugo MEDIUM 6.1
CVE-2026-50133

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (ty…

Fix: 0.162.0+
Fix from $1,600 2026-07-06
Hugo MEDIUM 5.8
CVE-2026-50134

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did …

Fix: 0.162.0+
Fix from $1,600 2026-07-06
Hugo HIGH 8.1
CVE-2026-44301

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, Tailwin…

Fix: 0.161.0+
Fix from $1,950 2026-05-12
Hugo MEDIUM 5.4
CVE-2026-35166

Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escap…

Fix: 0.159.2+
Fix from $1,600 2026-04-06
Hugo HIGH 8.5
CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc docu…

Fix: 0.79.1+
Fix from $1,950 2020-12-21