What’s Vulnerable › Products

avo-hq avo vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your avo-hq avo version is affected

Latest avo-hq avo vulnerabilities

• CVE-2026-53769 — Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy (CVSS 6.5)
• CVE-2026-55518 — Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation (CVSS 9.6)
• CVE-2026-42205 — Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources (CVSS 8.8)
• CVE-2026-33209 — Avo has a XSS vulnerability on `return_to` param (CVSS 6.1)
• CVE-2024-22411 — Cross site scripting in Action messages on Avo (CVSS 5.4)
• CVE-2024-22191 — Stored cross-site scripting (XSS) in `key_value` field in Avo (CVSS 5.4)
• CVE-2023-34103 — Stored XSS (Cross Site Scripting) in html content based fields of avo (CVSS 5.4)
• CVE-2023-34102 — Possible unsafe reflection / partial denial of service in avo (CVSS 8.8)