TI-2026-40064 CVE-2026-55518 · GHSA-8fq9-273g-6mrg
Authorization bypass in avo-hq avo
Priority HIGH 76
Avo is a framework to create admin panels for Ruby on Rails apps.
avo-hq
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
avo-hq records in CISA KEVNo avo-hq vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-30526 CVE-2026-42205 · GHSA-qc5p-3mg5-9fh8
Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources
Priority HIGH 73
Avo is a framework to create admin panels for Ruby on Rails apps.
TI-2023-16948 CVE-2023-34102 · GHSA-86h2-2g4g-29qx
Possible unsafe reflection / partial denial of service in avo
Priority HIGH 73
Avo is an open source ruby on rails admin panel creation framework.
TI-2023-16949 CVE-2023-34103 · GHSA-5cr9-5jx3-2g39
Stored XSS (Cross Site Scripting) in html content based fields of avo
Priority HIGH 67
Avo is an open source ruby on rails admin panel creation framework.
TI-2024-14784 CVE-2024-22191 · GHSA-ghjv-mh6x-7q6h
Stored cross-site scripting (XSS) in `key_value` field in Avo
Priority HIGH 65
Avo is a framework to create admin panels for Ruby on Rails apps.
TI-2026-38773 CVE-2026-53769 · GHSA-pqpw-cvm4-8mv9
Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Priority MEDIUM 62
Avo is a framework to create admin panels for Ruby on Rails apps.
TI-2024-14985 CVE-2024-22411 · GHSA-g8vp-2v5p-9qfh
Cross site scripting in Action messages on Avo
Priority MEDIUM 62
Avo is a framework to create admin panels for Ruby on Rails apps.
TI-2026-25630 CVE-2026-33209 · GHSA-762r-27w2-q22j
Avo has a XSS vulnerability on `return_to` param
Priority LOW 24
Avo is a framework to create admin panels for Ruby on Rails apps.