lanshi17 hugo blog vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 8.2CVE-2026-689052026-11-13

   Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /api/blog-assistant, POST /api/blog-search-embedding, POST /api/blog-search-rerank) without any authentication check. Whe…