Login Request a demo
HA
Product
halo
by halo-dev · last CVE Oct 26, 2026
37
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities37In the news0Timeline
Severity mix
Critical 10High 8Medium 17Low 2
Severity
All severities37Critical10High8Medium17Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add halo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-21527
7.7
1%
Sep 30
There is an Arbitrary file deletion vulnerability in halo v1.1.3
Affected: 1.1.3
CVE-2025-70886
7.5
1%
Feb 12
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
Affected: through 2.22.4
CVE-2022-26619
7.5
1%
Apr 5
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function
Affected: 1.4.17
CVE-2020-23079
7.5
1%
Jul 12
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet
Affected: through 1.3.2
CVE-2020-21525
7.5
2%
Sep 30
Halo V1.1.3 is affected by: Arbitrary File reading
Affected: 1.1.3
CVE-2026-116117
New
7.3
1%
Oct 26
halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
Affected: 2.27.0-beta.0; 2.27.0-beta.1
CVE-2026-97182
7.3
0%
Sep 24
halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
Affected: 2.25.0; 2.25.1; 2.25.2; 2.25.3; 2.25.4; 2.26.0; +1 more
CVE-2019-19999
7.2
2%
Dec 26
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration
Affected: through 1.1.1; 1.1.3; 1.1.3; 1.2.0
Showing 8