Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

avo

8 known vulnerabilities (1 critical, 4 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 1 critical, 4 high, 3 medium
Registry
RubyGems

Advisories 8

  • CVE-2026-53769Medium 6.5

    Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

    Affected: from 2.28.0, fixed in 3.32.0.

  • CVE-2026-55518Critical 9.6

    Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

    Affected: fixed in 3.32.1; from 4.0.0.beta.1, fixed in 4.0.0.beta.51.

  • Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

    Affected: fixed in 3.31.2.

  • CVE-2026-33209Medium 5.3

    Avo has a XSS vulnerability on `return_to` param

    Affected: fixed in 3.30.3.

  • CVE-2024-22411Medium 6.5

    Cross site scripting in Action messages on Avo

    Affected: from 3.0.0.beta1, fixed in 3.3.0; fixed in 2.47.0.

  • Stored cross-site scripting (XSS) in `key_value` field in Avo

    Affected: from 3.0.0.beta1, fixed in 3.2.4; fixed in 2.47.0.

  • Possible unsafe reflection / partial denial of service in avo

    Affected: fixed in 2.33.3; from 3.0.0.pre1, through 3.0.0.pre12.

  • Stored XSS (Cross Site Scripting) in html content based fields of avo

    Affected: fixed in 2.33.3; from 3.0.0.pre1, through 3.0.0.pre12.