https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-6203.htmlhttps://patchthecve.com/cve/CVE-2024-6203.htmlWed, 17 Jun 2026 08:17:30 +0000HIGH 8.3: HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email clienthttps://patchthecve.com/cve/CVE-2024-6202.htmlhttps://patchthecve.com/cve/CVE-2024-6202.htmlWed, 17 Jun 2026 08:17:30 +0000CRITICAL 9.8: HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.1https://patchthecve.com/cve/CVE-2024-6201.htmlhttps://patchthecve.com/cve/CVE-2024-6201.htmlWed, 17 Jun 2026 08:17:30 +0000MEDIUM 5.3: HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.https://patchthecve.com/cve/CVE-2024-6200.htmlhttps://patchthecve.com/cve/CVE-2024-6200.htmlWed, 17 Jun 2026 08:17:29 +0000HIGH 8.0: HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.