https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:32:27.600762+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333690 EUVD-2026-333690 2026-10-02T23:32:27.681987+00:00 EUVD-2026-333690 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50133 fkie_cve-2026-50133 2026-10-02T23:32:27.682027+00:00

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.

 https://cve.radiocsirt.org/vuln/ghsa-c54g-xjwj-8g82 GHSA-c54g-xjwj-8g82 — Hugo: XSS via text/html content files 2026-10-02T23:32:27.682064+00:00

Affected: Go: github.com/gohugoio/hugo

**Commit:** [e41a06447d](https://github.com/gohugoio/hugo/commit/e41a06447d) — _Disallow HTML content by default_ **Affected versions:** all Hugo versions prior to v0.162.0. **Fixed in:** v0.162.0. **Severity:** Low to Medium, depending on threat model. Not an issue if you fully trust every file under `/content` and every content adapter you load.

**Description.** Hugo accepts content files in several markup formats. Files mapped to the `text/html` media type (typically `.html` files under `/content`, or pages produced by a content adapter that sets `content.mediaType = "text/html"`) had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source — for example, a CMS-backed editor, a content adapter pulling from an external API, or an automated import pipeline — could therefore be served stored cross-site scripting.

**Mitigation.** v0.162.0 introduces a `security.allowContent` whitelist with `text/html` denied by default. Sites that intentionally author HTML content can opt back in:

```toml [security] allowContent = ['.*'] ```

This only affects pages whose source file (or content adapter output) declares an HTML media type; Markdown, AsciiDoc, Org, Pandoc and reStructuredText content is unaffected.

 https://cve.radiocsirt.org/vuln/rhsa-2026:36862 RHSA-2026:36862 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T23:32:27.682106+00:00

github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50133 UBUNTU-CVE-2026-50133 2026-10-02T23:32:27.682133+00:00

Affected: Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:25.10: hugo, Ubuntu:26.04:LTS: hugo

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.