CVE-2026-89259

Hugo , a static site generator, introduced Node's permission model in v0.161.0 to restrict tools executed during builds. However, TailwindCSS — present in the default security.exec.allow list — requires highly permissive flags (--allow-addons, --allow-child-process, --allow-worker), effectively b...

CVE-2026-89259 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

EUVD-2026-75801

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

PT-2026-90226

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/cxgb4 component. The c4iw remove function can free the ctx-dev object while registration work is still pending or running. This allows the c4iw...

Linux Distros Unpatched Vulnerability : CVE-2026-89258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups,...

PT-2026-89862

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

Linux Distros Unpatched Vulnerability : CVE-2026-89259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS included in the default...

PT-2026-89861

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

PT-2026-90190

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bq256xx power supply driver. The USB-PHY notifier queues usb work, which triggers the power supply changed function. Because the reset action was...

CVE-2026-89474: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usbwork before freeing the charger The USB-PHY notifier queues usbwork, whose handler calls powersupplychangedbq-charger. The reset devm action only unregisters the notifier and was registered before...

LLMVul: A Vulnerability-Labeled Dataset of LLM-Generated C/C++ Functions from Real Production Repositories

Large language models LLMs are increasingly used to generate and assist with software development, yet existing vulnerability datasets largely focus on human-written code or controlled prompting environments. This limits the ability to study security weaknesses in LLM-generated code as it appears...

CVE-2026-76059 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

GO-2026-6423 SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers in github.com/siyuan-note/siyuan/kernel...

CVE-2026-76059: Protection Mechanism Failure

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...