Ggohugoio

Products

Exploited and recent CVEs

• CVE-2026-109597 Medium 5.4 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs 0.2%
• CVE-2026-109596 Medium 5.5 Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor 0.1%
• CVE-2026-109595 Medium 5.5 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver 0.1%
• CVE-2026-109574 Medium 5.5 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback 0.1%
• CVE-2026-100694 Medium 6.1 Hugo before 0.166.0 Cross-Site Scripting via text/org 0.2%
• CVE-2026-100693 High 8.4 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass 0.1%
• CVE-2026-100692 High 7.5 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots 0.4%
• CVE-2026-100691 Medium 5.4 Hugo before 0.166.0 Stored XSS via lineAnchors code block option 0.2%
• CVE-2026-100690 High 7.5 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks 0.4%
• CVE-2026-89259 Critical 9.8 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS 0.6%
• CVE-2026-89258 Medium 6.3 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get 0.5%
• CVE-2026-10618 Medium 5.4 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values 0.3%
• CVE-2026-10582 High 7.4 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation 0.4%
• CVE-2026-75926 High 8.6 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant 0.3%
• CVE-2026-50135 Medium 6.9 Hugo: Symlink confinement bypass in resources.Get 0.4%
• CVE-2026-50134 Medium 6.3 Hugo: security.http.urls allow-list bypass via HTTP redirects 0.4%
• CVE-2026-50133 Medium 5.1 Hugo: XSS via text/html content files 0.3%
• CVE-2026-58403 Medium 5.9 Hugo symlink confinement bypass in os.ReadFile 0.5%
• CVE-2026-58402 Medium 5.1 Hugo default code block renderer XSS via unescaped code-fence language 0.3%
• CVE-2026-58404 Medium 4.6 Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings 0.4%
• CVE-2026-44301 Medium 6.2 Hugo: Node tool execution allows file system access outside the project directory 0.3%
• CVE-2026-35166 Medium 5.3 Hugo does not properly escape some Markdown links 0.2%
• CVE-2024-55601 Medium 5.3 Hugo does not escape some attributes in internal templates 0.6%
• CVE-2024-32875 Medium 6.1 Hugo doesn't escape markdown title in internal render hooks 0.5%
• CVE-2020-26284 High 7.7 Hugo can execute a binary from the current directory on Windows 1.5%