CVEs affecting projects tracked on Release Alert, from NVD & OSV.
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.