avo

RubyGems · Package

8 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fieldsCVE-2023-34103 · GHSA-5CR9-5JX3-2G39	avo	RubyGems	High	Fix reported	2026-09-10
avo possible unsafe reflection / partial DoS vulnerabilityCVE-2023-34102 · GHSA-86H2-2G4G-29QX	avo	RubyGems	High	Fix reported	2026-09-10
Cross-site scripting (XSS) in Action messages on AvoCVE-2024-22411 · GHSA-G8VP-2V5P-9QFH	avo	RubyGems	Medium	Fix reported	2026-09-10
avo vulnerable to stored cross-site scripting (XSS) in key_value fieldCVE-2024-22191 · GHSA-GHJV-MH6X-7Q6H	avo	RubyGems	High	Fix reported	2026-09-10
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationCVE-2026-55518 · GHSA-8FQ9-273G-6MRG	avo	RubyGems	Critical	Fix reported	2026-07-18
Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyCVE-2026-53769 · GHSA-PQPW-CVM4-8MV9	Red Hat Enterprise Linux 10/golang Red Hat Enterprise Linux 8/go-toolset:rhel8/golang	Red HatRubyGems	Medium	Fix reported	2026-07-10
Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across ResourcesCVE-2026-42205 · GHSA-QC5P-3MG5-9FH8	avo	RubyGems	High	Fix reported	2026-06-09
Avo has a XSS vulnerability on `return_to` paramCVE-2026-33209 · GHSA-762R-27W2-Q22J	avo	RubyGems	Medium	Fix reported	2026-03-25