What’s Vulnerable › Products
nicolargo glances vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.
Check whether your nicolargo glances version is affected
Latest nicolargo glances vulnerabilities
- CVE-2026-68520 — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config (CVSS 5.3)
- CVE-2026-68519 — Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) (CVSS 7.1)
- CVE-2026-62982 — Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection (CVSS 8.8)
- CVE-2026-68518 — Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction (CVSS 8.8)
- CVE-2026-68517 — Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard (CVSS 6.5)
- CVE-2026-53925 — Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration (CVSS 7.8)
- CVE-2026-46611 — Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack (CVSS 5.3)
- CVE-2026-46608 — Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) (CVSS 7.4)
- CVE-2026-46607 — Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution (CVSS 7.8)
- CVE-2026-46606 — Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py (CVSS 7.8)
- CVE-2026-35588 — Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values (CVSS 6.3)
- CVE-2026-35587 — Glances IP Plugin has SSRF via public_api that leads to credential leakage (CVSS 8.8)
- CVE-2026-34839 — Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS (CVSS 6.5)
- CVE-2026-33641 — Glances Vulnerable to Command Injection via Dynamic Configuration Values (CVSS 7.8)
- CVE-2026-33533 — Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard (CVSS 6.5)
- CVE-2026-32634 — Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers (CVSS 8.1)
- CVE-2026-32633 — Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` (CVSS 9.1)
- CVE-2026-32632 — Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding (CVSS 5.9)
- CVE-2026-32611 — Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements (CVSS 9.1)
- CVE-2026-32610 — Glances's Default CORS Configuration Allows Cross-Origin Credential Theft (CVSS 8.1)
- CVE-2026-32609 — Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials (CVSS 7.5)
- CVE-2026-32608 — Glances has a Command Injection via Process Names in Action Command Templates (CVSS 7.0)
- CVE-2026-32596 — Glances exposes the REST API without authentication (CVSS 7.5)
- CVE-2026-30930 — Glances has SQL Injection via Process Names in TimescaleDB Export (CVSS 9.8)
- CVE-2026-30928 — Glances Exposes Unauthenticated Configuration Secrets (CVSS 7.5)