Nicolargo Glances vulnerabilities

• nicolargo glances Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) CVE-2026-68519 Fix available 7.1 HighAugust 17, 2026
• nicolargo glances Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection CVE-2026-62982 Fix available 8.8 HighAugust 17, 2026
• nicolargo glances Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config CVE-2026-68520 Fix available 5.3 MediumAugust 17, 2026
• nicolargo glances Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard CVE-2026-68517 Fix available 6.5 MediumAugust 17, 2026
• nicolargo glances Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction CVE-2026-68518 Fix available 8.8 HighAugust 17, 2026
• nicolargo glances Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration CVE-2026-53925 Fix available 7.8 HighJune 23, 2026
• nicolargo glances Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack CVE-2026-46611 Fix available 5.3 MediumJune 22, 2026
• nicolargo glances Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) CVE-2026-46608 Fix available 7.4 HighJune 22, 2026
• nicolargo glances Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution CVE-2026-46607 Fix available 7.8 HighJune 22, 2026
• nicolargo glances Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py CVE-2026-46606 Fix available 7.8 HighJune 22, 2026
• nicolargo glances Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values CVE-2026-35588 Fix available 6.3 MediumApril 20, 2026
• nicolargo glances Glances IP Plugin has SSRF via public_api that leads to credential leakage CVE-2026-35587 Fix available 7.3 HighApril 20, 2026
• nicolargo glances Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS CVE-2026-34839 Fix available 7.7 HighApril 20, 2026
• nicolargo glances Glances Vulnerable to Command Injection via Dynamic Configuration Values CVE-2026-33641 Public exploitFix available 7.8 HighMarch 30, 2026
• nicolargo glances Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard CVE-2026-33533 Fix available 7.1 HighMarch 30, 2026
• nicolargo glances Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVE-2026-32634 Fix available 8.1 HighMarch 16, 2026
• nicolargo glances Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` CVE-2026-32633 Fix available 9.1 CriticalMarch 16, 2026
• nicolargo glances Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding CVE-2026-32632 Fix available 5.9 MediumMarch 16, 2026
• nicolargo glances Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements CVE-2026-32611 Fix available 7.0 HighMarch 16, 2026
• nicolargo glances Glances's Default CORS Configuration Allows Cross-Origin Credential Theft CVE-2026-32610 Fix available 8.1 HighMarch 16, 2026
• nicolargo glances Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVE-2026-32609 Fix available 7.5 HighMarch 16, 2026
• nicolargo glances Glances has a Command Injection via Process Names in Action Command Templates CVE-2026-32608 Fix available 7.0 HighMarch 16, 2026
• nicolargo glances Glances exposes the REST API without authentication CVE-2026-32596 Fix available 8.7 HighMarch 16, 2026
• nicolargo glances Glances has SQL Injection via Process Names in TimescaleDB Export CVE-2026-30930 Fix available 7.3 HighMarch 9, 2026
• nicolargo glances Glances Exposes Unauthenticated Configuration Secrets CVE-2026-30928 Fix available 8.7 HighMarch 9, 2026
• glances project glances XML External Entity (XXE) Injection CVE-2021-23418 Fix available 6.3 MediumJuly 29, 2021