GO
Vendor
gohugoio
24
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109597 | HU hugo gohugoio | 5.4 | Oct 12 | Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs |
| CVE-2026-109596 | HU hugo gohugoio | 5.5 | Oct 12 | Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor |
| CVE-2026-109595 | HU hugo gohugoio | 5.5 | Oct 12 | Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver |
| CVE-2026-109574 | HU hugo gohugoio | 5.5 | Oct 12 | Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback |
| CVE-2026-100694 | HU hugo gohugoio | 6.1 | Sep 26 | Hugo before 0.166.0 Cross-Site Scripting via text/org |
| CVE-2026-100693 | HU hugo gohugoio | 8.4 | Sep 26 | Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass |
| CVE-2026-100692 | HU hugo gohugoio | 7.5 | Sep 26 | Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots |
| CVE-2026-100691 | HU hugo gohugoio | 5.4 | Sep 26 | Hugo before 0.166.0 Stored XSS via lineAnchors code block option |
| CVE-2026-100690 | HU hugo gohugoio | 7.5 | Sep 26 | Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks |
| CVE-2026-89259 | HU hugo gohugoio | 9.8 | Sep 11 | Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS |
| CVE-2026-89258 | HU hugo gohugoio | 6.3 | Sep 11 | Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get |
| CVE-2026-10618 | HU hugo gohugoio | 5.4 | Aug 24 | Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values |
| CVE-2026-10582 | HU hugo gohugoio | 7.4 | Aug 24 | Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation |
| CVE-2026-75926 | HU hugo gohugoio | 8.6 | Aug 18 | Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant |
| CVE-2026-50135 | HU hugo gohugoio | 5.5 | Jul 6 | Hugo: Symlink confinement bypass in resources.Get |
| CVE-2026-50134 | HU hugo gohugoio | 5.8 | Jul 6 | Hugo: security.http.urls allow-list bypass via HTTP redirects |
| CVE-2026-50133 | HU hugo gohugoio | 6.1 | Jul 6 | Hugo: XSS via text/html content files |
| CVE-2026-58403 | HU hugo gohugoio | 6.5 | Jul 6 | Hugo symlink confinement bypass in os.ReadFile |
| CVE-2026-58402 | HU hugo gohugoio | 5.4 | Jul 6 | Hugo default code block renderer XSS via unescaped code-fence language |
| CVE-2026-58404 | HU hugo gohugoio | 6.8 | Jul 6 | Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings |
| CVE-2026-44301 | HU hugo gohugoio | 8.1 | May 12 | Hugo: Node tool execution allows file system access outside the project directory |
| CVE-2026-35166 | HU hugo gohugoio | 5.4 | Apr 6 | Hugo does not properly escape some Markdown links |
| CVE-2024-55601 | HU hugo gohugoio | 5.3 | Dec 9 | Hugo does not escape some attributes in internal templates |
| CVE-2024-32875 | HU hugo gohugoio | 6.1 | Apr 23 | Hugo doesn't escape markdown title in internal render hooks |