| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-109597 | vulnerable | vulnerable (no DSA) | fixed | fixed | Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripti ... |
| CVE-2026-109595 | vulnerable | vulnerable (no DSA) | fixed | fixed | Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerabil ... |
| CVE-2026-109574 | vulnerable | vulnerable (no DSA) | fixed | fixed | Hugo before v0.167.0 contains a path traversal vulnerability in css.Sa ... |
| CVE-2026-100694 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. In versions from v0.56.0 through v0.1 ... |
| CVE-2026-100692 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. In versions after v0.123.0 and before ... |
| CVE-2026-100691 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scrip ... |
| CVE-2026-89258 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. In versions after v0.123.0 and before ... |
| CVE-2026-58403 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo' ... |
| CVE-2026-58402 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's def ... |
| CVE-2026-50135 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression ... |
| CVE-2026-50134 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.91.0 until 0.162.0, resources. ... |
| CVE-2026-50133 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts conten ... |
| CVE-2026-44301 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.43 to before 0.161.0, when bui ... |
| CVE-2026-35166 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.60.0 to before 0.159.2, links ... |
| CVE-2026-10618 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo's default fenced-code-block renderer writes attribute values take ... |
| CVE-2026-10582 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo's security.http.urls allowlist is the only control on outbound fe ... |
| CVE-2024-55601 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. Starting in version 0.123.0 and prior ... |
| Bug | Description |
|---|
| CVE-2026-109596 | Hugo from v0.162.0 before v0.167.0 contains an improper link resolutio ... |
| CVE-2026-100693 | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive v ... |
| CVE-2026-100690 | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.Po ... |
| CVE-2026-89259 | Hugo is a static site generator. From v0.161.0, Hugo executes Node too ... |
| CVE-2026-75926 | Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permis ... |
| CVE-2026-58404 | Hugo is a static site generator. From v0.162.0 through v0.163.0, the d ... |
| CVE-2024-32875 | Hugo is a static site generator. Starting in version 0.123.0 and prior ... |
| CVE-2020-26284 | Hugo is a fast and Flexible Static Site Generator built in Go. Hugo de ... |