GHSA-73WF-9VMV-5PV9 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982

Glances versions 4.5.2 to 4.5.5 allow OS command injection via process cmdline values: _sanitize_mustache_dict() in glances/actions.py skips nested strings, letting pipe characters pass through chevron.render() and execute via secure_popen() in administrator-configured action templates. Fixed in ...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Summary The Glances action system lets an administrator configure shell commands that run when a monitoring threshold is crossed. The command is a Mustache template whose variables are filled with runtime stat fields such as a process name, a container name or a filesystem mount point. Those fiel...

GHSA-QCPP-8X79-HHP3 Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Summary The Glances action system lets an administrator configure shell commands that run when a monitoring threshold is crossed. The command is a Mustache template whose variables are filled with runtime stat fields such as a process name, a container name or a filesystem mount point. Those fiel...

CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-68518

Glances ≤ 4.5.5 has a command injection bypass in its action-template sanitizer. The function _sanitize_mustache_dict() in glances/actions.py strips shell operators (&&, |, >>, >) from each Mustache value individually before rendering, but does not strip a lone &. When an administrator-c...

CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Improper Serialization due to Apache Log4j JSON Template Layout

Summary Apache Log4j JSON Template Layout in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the encoding log events. CVE-2026-34481. Vulnerability Details CVEID:CVE-2026-34481 DESCRIPTION: Apache Log4j's JsonTemplateLayout...

CVE-2026-16268

creationtimestamp| type| source ---|---|--- 2026-08-17 06:00:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-16268.yaml 2026-08-18 00:00:03+00:00| confirmed|...

CVE-2026-6854

creationtimestamp| type| source ---|---|--- 2026-08-17 03:00:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-6854.yaml 2026-08-18 00:00:04+00:00| confirmed|...

PT-2026-76714

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitize mustache dict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure popen executes when...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165

CVE-2026-38165 is a Critical (CVSS 9.8) Server-Side Template Injection (SSTI) vulnerability in OpenSAGRES XDocReport versions 0.9.2 through 2.2.0 , specifically in the fr.opensagres.xdocreport.template.velocity component. When processing DOCX templates with the Apache Velocity engine, a crafted t...

PT-2026-76812

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...