Mnemosyne

Mnemosyne My personal infosec memo Fun fact The name of this project comes from the Greek goddess of memory: Mnemosyne. Moreover and regarding our story, it is interesting to note that, it's the origin of the word memory. Usage Mnemosyne is publicly available on the sub-domain of the same name of...

kismet-docs

OBSOLETO Este repositorio ahora está fusionado en el repositorio kismet-web-docs, y todos los cambios futuros deben realizarse allí. El nuevo motor del sitio utiliza Hugo, y varias de las partes de la documentación se han convertido a datos YAML con plantillas...

CVE-2026-75926

A flaw was found in Hugo. This vulnerability enables arbitrary command execution by bypassing security restrictions designed to confine asset-processing tools. Because TailwindCSS is granted permission to create child processes by default, an attacker providing a malicious theme, module, or...

CVE-2026-100693

A flaw was found in Hugo. Case-sensitive validation in the URL deny rule mechanism allows an attacker to bypass access restrictions. By supplying mixed-case URL schemes when fetching remote resources, an attacker can access restricted network destinations, such as localhost or internal IP...

CVE-2026-100692

A flaw was found in Hugo. This vulnerability enables information disclosure when building a site that includes a crafted theme or vendored module. Because Hugo fails to properly restrict symbolic links symlinks at mount roots, links pointing to directories outside the project directory are...

CVE-2026-100694

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

CVE-2026-100691

A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting XSS vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When...

CVE-2026-100690

A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a...

Linux Distros Unpatched Vulnerability : CVE-2026-100690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system...

Linux Distros Unpatched Vulnerability : CVE-2026-100693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-100692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme ...

Linux Distros Unpatched Vulnerability : CVE-2026-100694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw...

Linux Distros Unpatched Vulnerability : CVE-2026-100691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before...

DEBIAN-CVE-2026-100693

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-100694

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...

DEBIAN-CVE-2026-100694

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...

CVE-2026-100693

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

DEBIAN-CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

DEBIAN-CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...