CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

PT-2026-66858

Name of the Vulnerable Software and Affected Versions Hugo Leisink Hiawatha versions prior to 12.2 Description A flaw allows a remote attacker to execute arbitrary code by sending a specially crafted request to the server. Recommendations Update Hugo Leisink Hiawatha to version 12.2 or later...

EUVD-2026-51645

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2026-58402

A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting XSS. Successful...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

CVE-2026-50135

A flaw was found in Hugo, a static site generator. A regression in the resources.Get function caused it to follow symbolic links symlinks, which are special files that point to other files or directories. This vulnerability allows an attacker who can place a symlink within a local mount point, su...

CVE-2026-50133

A flaw was found in Hugo, a static site generator. This vulnerability allows a remote attacker to perform stored cross-site scripting XSS by ingesting untrusted HTML content files. When a site processes these malicious files, the embedded script is executed verbatim in the rendered page,...

CVE-2026-50134

A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, by controlling a server or its DNS, to redirect HTTP requests to a forbidden host. This bypasses the intended security policy, potentially leading to unauthorized access to resources or information disclosur...

CVE-2026-58403

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-configservice, crossplane-provider-azure-synapse, crossplane-provider-aws-emr, crossplane-provider-aws-swf-fips, crossplane-aws-monolith-fips, crossplane-provider-aws-codestarconnections-fips, crossplane-provider-aws-ses-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-configservice, crossplane-provider-azure-synapse, crossplane-provider-aws-emr, crossplane-provider-aws-swf-fips, crossplane-aws-monolith-fips, crossplane-provider-aws-codestarconnections-fips, crossplane-provider-aws-ses-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-memorydb, hugo, crossplane-provider-azure-managedidentity, grafana, crossplane-provider-azure-storage, crossplane-provider-azure-sql, dataplaneapi,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-memorydb, hugo, crossplane-provider-azure-managedidentity, grafana, crossplane-provider-azure-storage, crossplane-provider-azure-sql, dataplaneapi,...

GO-2026-5740 Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo

Hugo's Node tool execution allows file system access outside the project directory in github.com/gohugoio/hugo...

CVE-2026-24233

creationtimestamp| type| source ---|---|--- 2026-07-14 23:09:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnda3ee6c2x 2026-07-14 23:10:46+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqndckyvok2v 2026-07-14 23:11:04+00:00| seen|...

github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer

A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting XSS. Successful...

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files

A flaw was found in Hugo, a static site generator. This vulnerability allows a remote attacker to perform stored cross-site scripting XSS by ingesting untrusted HTML content files. When a site processes these malicious files, the embedded script is executed verbatim in the rendered page,...