{"kind": "product", "path": "vulns/debian-12/glances", "name": "glances", "product": "glances", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-68520", "noindex": false, "published": "2026-08-17T17:06:06.446Z", "modified": "2026-08-17T19:36:26.683Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-68520", "title": "Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-4h34-v6r8-mmjc", "https://github.com/nicolargo/glances/commit/8d0f8276c2abd2e9d400bd6c84bdfba0dfcab065", "https://github.com/nicolargo/glances/releases/tag/v4.5.6"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-68517", "noindex": false, "published": "2026-08-17T17:03:23.346Z", "modified": "2026-08-18T14:48:25.958Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-68517", "title": "Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg", "https://github.com/nicolargo/glances/commit/890858944ab9d03730ec6b1ba42d4015e6d85db5", "https://github.com/nicolargo/glances/releases/tag/v4.5.6"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-68518", "noindex": false, "published": "2026-08-17T16:18:29.391Z", "modified": "2026-08-17T19:37:48.603Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "high", "epss": 0.00173, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-68518", "title": "Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3", "https://github.com/nicolargo/glances/commit/9c280eae5419da680827024b60f6265956e31994", "https://github.com/nicolargo/glances/releases/tag/v4.5.6"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-46607", "noindex": false, "published": "2026-06-25T18:04:25.780Z", "modified": "2026-06-25T18:49:32.136Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0019, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46607", "title": "Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checkin", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j", "https://github.com/nicolargo/glances/releases/tag/v4.5.5", "https://nvd.nist.gov/vuln/detail/CVE-2026-46607"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-53925", "noindex": false, "published": "2026-06-25T18:03:43.333Z", "modified": "2026-06-25T18:25:13.508Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00185, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53925", "title": "Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration", "description": "Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbit", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7", "https://nvd.nist.gov/vuln/detail/CVE-2026-53925"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-46611", "noindex": false, "published": "2026-06-25T18:00:47.735Z", "modified": "2026-06-26T02:14:42.354Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00145, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46611", "title": "Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "https://github.com/nicolargo/glances/releases/tag/v4.5.5", "https://nvd.nist.gov/vuln/detail/CVE-2026-46611"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-35588", "noindex": false, "published": "2026-04-20T23:20:34.998Z", "modified": "2026-04-21T13:35:04.526Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "severity": "medium", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35588", "title": "Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7", "https://github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160", "https://github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48c"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-35587", "noindex": false, "published": "2026-04-20T23:19:02.908Z", "modified": "2026-04-22T14:01:47.583Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00396, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35587", "title": "Glances IP Plugin has SSRF via public_api that leads to credential leakage", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. The value of public_api is used directly in outbound HTTP requests without any scheme restriction or hostname/IP validation. An attacker who can modify the Glances configuration can force the application to send requests to arbitrary internal or external endpoints. Additionally, when public_username and public_password are set, Glances automatically includes these credentials in the Authorization: Basic h", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8", "https://github.com/nicolargo/glances/commit/d6808be66728956477cc4b544bab1acd71ac65fb", "https://nvd.nist.gov/vuln/detail/CVE-2026-35587"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-34839", "noindex": false, "published": "2026-04-20T23:09:02.551Z", "modified": "2026-04-21T19:37:42.399Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34839", "title": "Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. ", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-gfc2-9qmw-w7vh", "https://github.com/nicolargo/glances/commit/fdfb977b1d91b5e410bc06c4e19f8bedb0005ce9", "https://nvd.nist.gov/vuln/detail/CVE-2026-34839"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-33641", "noindex": false, "published": "2026-04-02T14:57:51.120Z", "modified": "2026-04-02T16:22:08.154Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00903, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33641", "title": "Glances Vulnerable to Command Injection via Dynamic Configuration Values", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lea", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7", "https://github.com/nicolargo/glances/commit/358d76a225fc21a9f95d2c4d7e46fafe64a644c6", "https://github.com/nicolargo/glances/releases/tag/v4.5.3"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-33533", "noindex": false, "published": "2026-04-02T14:56:38.762Z", "modified": "2026-04-02T18:48:01.060Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00345, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33533", "title": "Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS \"simple request\" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7", "https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1", "https://github.com/nicolargo/glances/releases/tag/v4.5.3"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32634", "noindex": false, "published": "2026-03-18T17:55:30.552Z", "modified": "2026-03-18T18:36:07.432Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00296, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32634", "title": "Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glance", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm", "https://github.com/nicolargo/glances/commit/61d38eec521703e41e4933d18d5a5ef6f854abd5", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32633", "noindex": false, "published": "2026-03-18T17:53:11.263Z", "modified": "2026-03-18T18:35:27.562Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00491, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32633", "title": "Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network u", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m", "https://github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32632", "noindex": false, "published": "2026-03-18T17:47:25.929Z", "modified": "2026-03-18T18:15:59.648Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32632", "title": "Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding", "description": "Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does not apply `TrustedHostMiddleware` or an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the ori", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-hhcg-r27j-fhv9", "https://github.com/nicolargo/glances/commit/5850c564ee10804fdf884823b9c210eb954dd1f9", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32611", "noindex": false, "published": "2026-03-18T17:21:18.668Z", "modified": "2026-03-18T18:51:23.479Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "severity": "high", "epss": 0.00338, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32611", "title": "Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements", "description": "Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table ", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-49g7-2ww7-3vf5", "https://github.com/nicolargo/glances/commit/63b7da28895249d775202d639e5531ba63491a5c", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32610", "noindex": false, "published": "2026-03-18T16:31:12.154Z", "modified": "2026-03-18T16:59:40.327Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00345, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32610", "title": "Glances's Default CORS Configuration Allows Cross-Origin Credential Theft", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=[\"*\"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configurat", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-9jfm-9rc6-2hfq", "https://github.com/nicolargo/glances/commit/4465169b71d93991f1e49740fe02428291099832", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32609", "noindex": false, "published": "2026-03-18T14:30:37.786Z", "modified": "2026-03-18T14:46:18.186Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00508, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32609", "title": "Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials", "description": "Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible wit", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-cvwp-r2g2-j824", "https://github.com/nicolargo/glances/commit/ff14eb9780ee10ec018c754754b1c8c7bfb6c44f", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32608", "noindex": false, "published": "2026-03-18T06:03:22.153Z", "modified": "2026-03-18T15:39:15.123Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32608", "title": "Glances has a Command Injection via Process Names in Action Command Templates", "description": "Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or conta", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-vcv2-q258-wrg7", "https://github.com/nicolargo/glances/commit/6f4ec53d967478e69917078e6f73f448001bf107", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-32596", "noindex": false, "published": "2026-03-18T05:18:11.547Z", "modified": "2026-03-18T15:45:18.808Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0155, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32596", "title": "Glances exposes the REST API without authentication", "description": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.", "references": ["https://github.com/nicolargo/glances/security/advisories/GHSA-wvxv-4j8q-4wjq", "https://github.com/nicolargo/glances/commit/208d876118fea5758970f33fd7474908bd403d25", "https://github.com/nicolargo/glances/releases/tag/v4.5.2"], "fixes": [], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}, {"id": "CVE-2021-23418", "noindex": false, "published": "2021-07-29T17:50:12.851Z", "modified": "2024-09-16T17:38:39.943Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.01653, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-23418", "title": "XML External Entity (XXE) Injection", "description": "The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.", "references": ["https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807", "https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94", "https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a"], "fixes": ["3.2.3.1+dfsg-1"], "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "glances", "path": "vulns/debian-12/glances", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-18T14:48:25.958Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}