CVE-2026-42205 Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class descendants of...

The vulnerability of the GDI component in Windows operating systems, which allows a hacker to execute arbitrary code

The vulnerability of the GDI component in Windows operating systems is related to the use of an insecure lookup path. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of the open-source DHCP server Kea, related to an unreliable search process, allows attackers to elevate privileges within the system.

The vulnerability of the open-source DHCP server Kea is related to the use of an insecure lookup path. Exploiting this vulnerability can allow a attacker to gain increased privileges within the system...

The vulnerability of Fortinet FortiClient Windows security devices, related to the use of an insecure search path, allows attackers to execute arbitrary code.

The vulnerability of Fortinet FortiClient Windows protection devices is related to the use of an insecure lookup path. Exploiting this vulnerability allows attackers to execute arbitrary code...