Halo vulnerabilities
CVEs whose affected-version data names the Halo package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-97182High· 7.3PoCA security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component…
▾ Midnighthalo-dev · Halovia NVD
CVE-2026-91772Medium· 6.1PoCHalo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbi…
▾ Twilighthalo-dev · haloEPSS 0.18%via NVD