CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

UBUNTU-CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...

CVE-2026-68517

In Glances versions prior to 4.5.6, glances_restful_api.py:298 uses exact list equality (cors_origins == ["*"]) instead of a membership test, so any multi-origin allowlist containing the wildcard bypasses the credentials-disable guard. Starlette's CORSMiddleware still reflects arbitrary origins w...

CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68517 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68517 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

EUVD-2026-60301

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:3631-1 Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: - CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393...

SUSE CVE-2026-58015

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

SUSE CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-75053

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint...

EUVD-2026-60261

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...

CVE-2026-72003

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE Simultaneous Authentication of Equals authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary...

Important: Red Hat Security Advisory: 389-ds-base security update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27771

In UpTrain versions 0.7.1 and earlier, the /add_prompts endpoint accepts untrusted checks and metadata parameters that are deserialized and evaluated without sanitization, enabling arbitrary Python code execution. An authenticated user can achieve full host compromise (typically the Docker contai...