| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-100694 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | Hugo is a static site generator. In versions from v0.56.0 through v0.1 ... |
| CVE-2026-100693 | fixed | fixed | vulnerable | fixed | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive v ... |
| CVE-2026-100692 | fixed | vulnerable (no DSA) | vulnerable | fixed | Hugo is a static site generator. In versions after v0.123.0 and before ... |
| CVE-2026-100691 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scrip ... |
| CVE-2026-100690 | fixed | fixed | vulnerable | fixed | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.Po ... |
| CVE-2026-89258 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. In versions after v0.123.0 and before ... |
| CVE-2026-58403 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo' ... |
| CVE-2026-58402 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's def ... |
| CVE-2026-50135 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression ... |
| CVE-2026-50134 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.91.0 until 0.162.0, resources. ... |
| CVE-2026-50133 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts conten ... |
| CVE-2026-44301 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.43 to before 0.161.0, when bui ... |
| CVE-2026-35166 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.60.0 to before 0.159.2, links ... |
| CVE-2026-10618 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | Hugo's default fenced-code-block renderer writes attribute values take ... |
| CVE-2026-10582 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | Hugo's security.http.urls allowlist is the only control on outbound fe ... |
| CVE-2024-55601 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. Starting in version 0.123.0 and prior ... |