avo-hq vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20242
3. 20264

Newest CVEs

• CVE-2026-53769

  Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

  avo-hq · avo

  Medium6.5
• CVE-2026-55518

  Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

  avo-hq · avo

  Critical9.6
• CVE-2026-42205

  Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

  avo-hq · avo

  High8.8
• CVE-2026-33209

  Avo has a XSS vulnerability on `return_to` param

  avo-hq · avo

  Medium5.3
• CVE-2024-22411

  Cross site scripting in Action messages on Avo

  avo-hq · avo

  Medium6.5
• CVE-2024-22191

  Stored cross-site scripting (XSS) in `key_value` field in Avo

  avo-hq · avo

  High7.3
• CVE-2023-34102

  Possible unsafe reflection / partial denial of service in avo

  avo-hq · avo

  High8.3
• CVE-2023-34103

  Stored XSS (Cross Site Scripting) in html content based fields of avo

  avo-hq · avo

  High7.3