Vulnerabilities

TI-2026-38773 CVE-2026-53769 · GHSA-pqpw-cvm4-8mv9

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

MEDIUM 62

Avo is a framework to create admin panels for Ruby on Rails apps.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00423 Published 2026-09-04 Partial fix · 3.32.0 CWE-862

TI-2026-40064 CVE-2026-55518 · GHSA-8fq9-273g-6mrg

HIGH 76

Avo is a framework to create admin panels for Ruby on Rails apps.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00411 Published 2026-07-17 Fixed in 4.0.0.beta.51, 3.32.1 CWE-639

TI-2026-30526 CVE-2026-42205 · GHSA-qc5p-3mg5-9fh8

HIGH 73

Avo is a framework to create admin panels for Ruby on Rails apps.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00295 Published 2026-05-08 Fixed in 3.31.2 CWE-284

TI-2026-25630 CVE-2026-33209 · GHSA-762r-27w2-q22j

LOW 24

Avo is a framework to create admin panels for Ruby on Rails apps.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00274 Published 2026-03-20 Fixed in 3.30.3 CWE-79

TI-2024-14985 CVE-2024-22411 · GHSA-g8vp-2v5p-9qfh

MEDIUM 62

Avo is a framework to create admin panels for Ruby on Rails apps.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0071 Published 2024-01-16 Fixed in 3.3.0, 2.47.0 CWE-79

TI-2024-14784 CVE-2024-22191 · GHSA-ghjv-mh6x-7q6h

HIGH 65

Avo is a framework to create admin panels for Ruby on Rails apps.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00745 Published 2024-01-16 Fixed in 3.2.4, 2.47.0 CWE-79

TI-2023-16948 CVE-2023-34102 · GHSA-86h2-2g4g-29qx

HIGH 73

Avo is an open source ruby on rails admin panel creation framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0161 Published 2023-06-05 Fixed in 2.33.3 CWE-20

TI-2023-16949 CVE-2023-34103 · GHSA-5cr9-5jx3-2g39

HIGH 67

Avo is an open source ruby on rails admin panel creation framework.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00563 Published 2023-06-05 Fixed in 2.33.3 CWE-79