https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 21:29:36 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-109574 <p>Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler&#39;s import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.</p> <p>Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler&#39;s import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.</p> https://db.gcve.eu/vuln/fkie_cve-2026-109574 https://db.gcve.eu/vuln/ghsa-454m-4vr5-7p63 <p>Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler&#39;s import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.</p> <p>Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler&#39;s import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.</p> https://db.gcve.eu/vuln/ghsa-454m-4vr5-7p63 https://db.gcve.eu/vuln/rhsa-2026:80677 <p>google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON hugo: Hugo: Information disclosure via Sass import path traversal hugo: Hugo: Information disclosure via path traversal during asset compilation hugo: Hugo: Information disclosure via improper link resolution in nested mounts hugo: Hugo: Stored cross-site scripting via crafted heading identifiers</p> <p>google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON hugo: Hugo: Information disclosure via Sass import path traversal hugo: Hugo: Information disclosure via path traversal during asset compilation hugo: Hugo: Information disclosure via improper link resolution in nested mounts hugo: Hugo: Stored cross-site scripting via crafted heading identifiers</p> https://db.gcve.eu/vuln/rhsa-2026:80677 https://db.gcve.eu/vuln/ubuntu-cve-2026-109574 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:26.10: hugo, Ubuntu:26.04:LTS: hugo</p> <p>Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler&#39;s import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:26.10: hugo, Ubuntu:26.04:LTS: hugo</p> <p>Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler&#39;s import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-109574