Skip to content
Nicolargo vulnerabilities
Newest
-
nicolargo glances
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
CVE-2026-68519
Fix available
7.1 High
-
nicolargo glances
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
CVE-2026-62982
Fix available
8.8 High
-
nicolargo glances
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
CVE-2026-68520
Fix available
5.3 Medium
-
nicolargo glances
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
CVE-2026-68517
Fix available
6.5 Medium
-
nicolargo glances
Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
CVE-2026-68518
Fix available
8.8 High
-
nicolargo glances
Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
CVE-2026-53925
Fix available
7.8 High
-
nicolargo glances
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
CVE-2026-46611
Fix available
5.3 Medium
-
nicolargo glances
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
CVE-2026-46608
Fix available
7.4 High
-
nicolargo glances
Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution
CVE-2026-46607
Fix available
7.8 High
-
nicolargo glances
Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
CVE-2026-46606
Fix available
7.8 High
-
nicolargo glances
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
CVE-2026-35588
Fix available
6.3 Medium
-
nicolargo glances
Glances IP Plugin has SSRF via public_api that leads to credential leakage
CVE-2026-35587
Fix available
7.3 High
-
nicolargo glances
Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
CVE-2026-34839
Fix available
7.7 High
-
nicolargo glances
Glances Vulnerable to Command Injection via Dynamic Configuration Values
CVE-2026-33641
Public exploitFix available
7.8 High
-
nicolargo glances
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
CVE-2026-33533
Fix available
7.1 High
-
nicolargo glances
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
CVE-2026-32634
Fix available
8.1 High
-
nicolargo glances
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
CVE-2026-32633
Fix available
9.1 Critical
-
nicolargo glances
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
CVE-2026-32632
Fix available
5.9 Medium
-
nicolargo glances
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
CVE-2026-32611
Fix available
7.0 High
-
nicolargo glances
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
CVE-2026-32610
Fix available
8.1 High
-
nicolargo glances
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
CVE-2026-32609
Fix available
7.5 High
-
nicolargo glances
Glances has a Command Injection via Process Names in Action Command Templates
CVE-2026-32608
Fix available
7.0 High
-
nicolargo glances
Glances exposes the REST API without authentication
CVE-2026-32596
Fix available
8.7 High
-
nicolargo glances
Glances has SQL Injection via Process Names in TimescaleDB Export
CVE-2026-30930
Fix available
7.3 High
-
nicolargo glances
Glances Exposes Unauthenticated Configuration Secrets
CVE-2026-30928
Fix available
8.7 High
-
glances project glances
XML External Entity (XXE) Injection
CVE-2021-23418
Fix available
6.3 Medium