halo-dev has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.3 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-97182High· 7.3A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.152CVE-2026-91772Medium· 6.1Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter46CVE-2026-116117High· 7.3halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal40
halo-dev vulnerabilities
CVEs affecting halo-dev, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-116117High· 7.3halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/Defau…
CVE-2026-97182High· 7.3PoCA security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component…
CVE-2026-91772Medium· 6.1PoCHalo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbi…