avo-hq/avo Security Advisories | GitStock

medium2026-07-09

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

GHSA-pqpw-cvm4-8mv9 · CVE-2026-53769

critical2026-06-17

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

GHSA-8fq9-273g-6mrg · CVE-2026-55518

high2026-04-24

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

GHSA-qc5p-3mg5-9fh8 · CVE-2026-42205

medium2026-03-18

Avo has a XSS vulnerability on `return_to` param

GHSA-762r-27w2-q22j · CVE-2026-33209

medium2024-01-17

Cross-site scripting (XSS) in Action messages on Avo

GHSA-g8vp-2v5p-9qfh · CVE-2024-22411

high2024-01-16

avo vulnerable to stored cross-site scripting (XSS) in key_value field

GHSA-ghjv-mh6x-7q6h · CVE-2024-22191

high2023-06-06

avo possible unsafe reflection / partial DoS vulnerability

GHSA-86h2-2g4g-29qx · CVE-2023-34102

high2023-06-06

avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

GHSA-5cr9-5jx3-2g39 · CVE-2023-34103