RubyGems/avo

avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

Modified: 9/10/2026

Avo has a XSS vulnerability on `return_to` param

Modified: 3/25/2026

avo possible unsafe reflection / partial DoS vulnerability

Modified: 9/10/2026

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

Modified: 7/18/2026

Cross-site scripting (XSS) in Action messages on Avo

Modified: 9/10/2026

avo vulnerable to stored cross-site scripting (XSS) in key_value field

Modified: 9/10/2026

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Modified: 7/9/2026

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

Modified: 6/8/2026