SUSE CVE-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

EUVD-2026-51645

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

PT-2026-66858

Name of the Vulnerable Software and Affected Versions Hugo Leisink Hiawatha versions prior to 12.2 Description A flaw allows a remote attacker to execute arbitrary code by sending a specially crafted request to the server. Recommendations Update Hugo Leisink Hiawatha to version 12.2 or later...

CVE-2026-51785: Improper Control of Generation of Code

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2026-58402

A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting XSS. Successful...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

CVE-2026-50135

A flaw was found in Hugo, a static site generator. A regression in the resources.Get function caused it to follow symbolic links symlinks, which are special files that point to other files or directories. This vulnerability allows an attacker who can place a symlink within a local mount point, su...

CVE-2026-50133

A flaw was found in Hugo, a static site generator. This vulnerability allows a remote attacker to perform stored cross-site scripting XSS by ingesting untrusted HTML content files. When a site processes these malicious files, the embedded script is executed verbatim in the rendered page,...

CVE-2026-50134

A flaw was found in Hugo, a static site generator. This vulnerability allows an attacker, by controlling a server or its DNS, to redirect HTTP requests to a forbidden host. This bypasses the intended security policy, potentially leading to unauthorized access to resources or information disclosur...

CVE-2026-58403

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp-fips, crossplane-provider-aws-cloudsearch-fips, crossplane-provider-aws-dax-fips, crossplane-provider-aws-mwaa-fips, crossplane-provider-aws-sesv2-fips, crossplane-provider-aws-dataexchange-fips, crossplane-provider-aws-appflow-fips,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp-fips, crossplane-provider-aws-cloudsearch-fips, crossplane-provider-aws-dax-fips, crossplane-provider-aws-mwaa-fips, crossplane-provider-aws-sesv2-fips, crossplane-provider-aws-dataexchange-fips, crossplane-provider-aws-appflow-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, crossplane-provider-aws-lambda, crossplane-provider-azure-sql, crossplane-provider-aws-sns, crossplane-provider-family-aws, crossplane-provider-aws-rds, crossplane-provider-aws-route53, gitness, grafana, hugo-extended,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, crossplane-provider-aws-lambda, crossplane-provider-azure-sql, crossplane-provider-aws-sns, crossplane-provider-family-aws, crossplane-provider-aws-rds, crossplane-provider-aws-route53, gitness, grafana, hugo-extended,...

JLSEC-2026-796 XSS via unescaped code-fence language in default code block renderer

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out...

JLSEC-2026-795 Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

JLSEC-2026-792 Hugo: Certain markdown links are not properly escaped

Impact Links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. Patches Patched in v0.159.2 Workarounds Create custom render hooks for links and images in...

JLSEC-2026-794 Hugo: XSS via text/html content files

Commit: e41a06447d — Disallow HTML content by default Affected versions: all Hugo versions prior to v0.162.0. Fixed in: v0.162.0. Severity: Low to Medium, depending on threat model. Not an issue if you fully trust every file under /content and every content adapter you load. Description. Hugo...