CVE-2026-123665

LowCVSS 2.8/10Last modified Nov 9, 2026

Description

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access. Upgrading to version 4.0.16 is recommended to address this issue. This patch is called d90f77314c7d4f2b53cf2425844bde2315bd26d2. Upgrading the affected component is advised.

Metrics

CVSS 3.1 2.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266 CWE-275

Affected software

Vendor	Product	Versions
n/a	kubescape	4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6; 4.0.7; 4.0.8; 4.0.9; 4.0.10; 4.0.11; 4.0.12; 4.0.13; 4.0.14; 4.0.15

References

Timeline

Published: Nov 6, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1236664.9The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection CVE-2026-1236676.4The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them CVE-2026-1236685.3The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthen CVE-2026-1236758.3A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code o CVE-2026-1236765.3A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the CVE-2026-1236774.3A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/githu CVE-2026-1236959.8The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenti CVE-2026-1236967.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor aut CVE-2026-1236977.5The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-facto CVE-2026-1236985.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticate CVE-2026-1236994.8The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security Fo CVE-2026-12372.1Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to up