| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-89259 | vulnerable | vulnerable | fixed | fixed | Hugo is a static site generator. From v0.161.0, Hugo executes Node too ... |
| CVE-2026-89258 | vulnerable | vulnerable | fixed | fixed | Hugo is a static site generator. In versions after v0.123.0 and before ... |
| CVE-2026-58403 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo' ... |
| CVE-2026-58402 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's def ... |
| CVE-2026-50135 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression ... |
| CVE-2026-50134 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.91.0 until 0.162.0, resources. ... |
| CVE-2026-50133 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts conten ... |
| CVE-2026-44301 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.43 to before 0.161.0, when bui ... |
| CVE-2026-35166 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. From 0.60.0 to before 0.159.2, links ... |
| CVE-2026-10618 | vulnerable | vulnerable (no DSA) | vulnerable | vulnerable | Hugo's default fenced-code-block renderer writes attribute values take ... |
| CVE-2026-10582 | vulnerable | vulnerable (no DSA) | vulnerable | vulnerable | Hugo's security.http.urls allowlist is the only control on outbound fe ... |
| CVE-2024-55601 | fixed | vulnerable (no DSA) | fixed | fixed | Hugo is a static site generator. Starting in version 0.123.0 and prior ... |