Halo

This hub aggregates every CVE we track for Halo, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Halo.

• CVE-2026-97182halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization7.3Sep 24, 2026
• CVE-2026-91772Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter6.1Sep 15, 2026
• CVE-2026-16088halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal4.7Jul 18, 2026
• CVE-2026-15326halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal3.8Jul 10, 2026
• CVE-2026-55439Halo: Path Traversal in Backup Download Leads to Arbitrary File Read5.5Jun 25, 2026
• CVE-2025-70886An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint7.5Feb 12, 2026
• CVE-2025-15141Halo Configuration actuator information disclosure3.1Dec 28, 2025
• CVE-2025-14117fit2cloud Halo cross-site request forgery4.3Dec 6, 2025
• CVE-2025-44595Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.6.1Sep 9, 2025
• CVE-2025-44594halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.9.1Sep 9, 2025
• CVE-2025-44593Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnera...6.1Sep 9, 2025
• CVE-2024-56156Halo Vulnerable to Stored XSS and RCE via File Upload Bypass9.0Apr 25, 2025
• CVE-2024-43793Halo's editor has a stored XSS vulnerability6.3Sep 11, 2024
• CVE-2024-43792Halo's editor has a stored Cross-Site Scripting vulnerability6.3Sep 2, 2024
• CVE-2023-33528halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).6.1Mar 28, 2024