Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

type:lpe — CVE vulnerabilities tagged 6818

6818 CVE security advisories tagged "type:lpe" with AI Chinese analysis, CVSS, references and POCs.

The tag "type:lpe" identifies Local Privilege Escalation vulnerabilities, a critical security flaw where an attacker with limited user access exploits system weaknesses to gain elevated administrative rights. This matters significantly because it allows malicious actors to bypass standard security controls, potentially accessing sensitive data, installing malware, or compromising the entire system from a low-privilege entry point. Typical scenarios involve exploiting bugs in kernel code, misconfigured permissions, or vulnerable system services that improperly validate user inputs. Since many initial breaches start with low-level access, such as phishing or web exploits, LPE serves as a vital second stage for attackers aiming for full system control. Understanding these vulnerabilities is essential for developers to implement proper access controls and for administrators to patch systems promptly, thereby preventing lateral movement and maintaining overall infrastructure integrity against sophisticated threat actors.

CVE ID Title CVSS Severity Published
CVE-2026-106586 OpenSSH <10.6 restricted关键字隧道转发绕过 — OpenSSH CWE-670 2.5 Low 2026-10-06
CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation — backstage CWE-269 7.6 High 2026-10-06
CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion — backstage CWE-863 5.4 Medium 2026-10-06
CVE-2026-102160 Security Advisory 0190 — CloudVision CUE CWE-78 7.2 High 2026-10-06
CVE-2026-101158 Security Advisory 0185 — CloudVision Portal CWE-79 8.4 High 2026-10-06
CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation — Elasticsearch CWE-863 7.2 High 2026-10-06
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner — Gitea CWE-863 - - 2026-10-06
CVE-2026-76061 Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass CWE-59 5.5 Medium 2026-10-06
CVE-2026-101027 Gitea migration SSRF through ALLOWED_DOMAINS address check bypass — Gitea - - 2026-10-06
CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun — Gitea - - 2026-10-06
CVE-2026-79816 Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface — ClearPass Policy Manager (CPPM) 5.4 Medium 2026-10-06
CVE-2026-79815 Authenticated Command Injection Vulnerability in the ClearPass Policy Manager OnGuard Agent — ClearPass Policy Manager (CPPM) 6.5 Medium 2026-10-06
CVE-2026-79813 Local Privilege Escalation in ClearPass Client Software — ClearPass Policy Manager (CPPM) 6.7 Medium 2026-10-06
CVE-2026-79809 Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass — ClearPass Policy Manager (CPPM) 7.3 High 2026-10-06
CVE-2026-79808 Local Authenticated Buffer Overflow Vulnerability in the ClearPass Policy Manager OnGuard Agent — ClearPass Policy Manager (CPPM) 7.8 High 2026-10-06
CVE-2026-79803 Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager API — ClearPass Policy Manager (CPPM) 8.8 High 2026-10-06
CVE-2026-79802 Command Injection Vulnerability in the ClearPass Policy Manager Client Software — ClearPass Policy Manager (CPPM) 8.8 High 2026-10-06
CVE-2026-79800 Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager — ClearPass Policy Manager (CPPM) 8.8 High 2026-10-06
CVE-2026-76751 Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution — ClearPass Policy Manager (CPPM) 9.8 Critical 2026-10-06
CVE-2026-76748 Authenticated Privilege Escalation Vulnerability in the API of AOS-S — AOS-Switch (AOS-S) 8.8 High 2026-10-06
CVE-2026-106441 Hydra logging configuration permits unsafe callable resolution — hydra CWE-94 7.8 High 2026-10-06
CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links — netbox CWE-668 7.6 High 2026-10-06
CVE-2026-82162 Dell Command Configure 5.2.3.35前版本混合编码提权漏洞 — Command | Configure (DCC) CWE-175 7.4 High 2026-10-06
CVE-2026-106294 Chrome Mac <155.0.8059.39 越权访问漏洞 — Chrome CWE-459 - - 2026-10-06
CVE-2026-106339 Chrome<155.0.8059.39跨域数据泄露漏洞 — Chrome CWE-672 - - 2026-10-06
CVE-2026-106247 Chrome <155.0.8059.39 ANGLE缓冲区溢出漏洞 — Chrome CWE-122 - - 2026-10-06
CVE-2026-106191 Chrome <155.0.8059.39 权限缺失致远程代码执行 — Chrome CWE-862 - - 2026-10-06
CVE-2026-106404 Google Chrome <155.0.8059.39 FontAccess授权绕过漏洞 — Chrome CWE-863 - - 2026-10-06
CVE-2026-106401 Chrome 155.0.8059.39前越界写入漏洞 — Chrome CWE-787 - - 2026-10-06
CVE-2026-106403 Chrome <155.0.8059.39 辅助功能授权缺陷 — Chrome CWE-863 - - 2026-10-06

Vulnerabilities classified as type:lpe represent 6818 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.