646 matches found
Glances - Information Disclosure
Glances 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges. id: CVE-2026-32596 info: name: Glances -...
Glances - Information Disclosure
Glances 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access. id: CVE-2026-30928 info: name: Glances - Information...
Glances XMLRPC Handler Unauthorized Access
The vulnerability of the GlancesXMLRPCHandler and GlancesXMLRPCServer methods in the glances/server.py file of the Glances monitoring tool’s application programming interface is related to a deficiency in the source verification mechanism. Exploiting this vulnerability could allow an attacker to...
Glances Input Validation
The vulnerability of the application programming interface of the Glances monitoring tool is related to improper verification of the data entered by the user against a list of allowed values. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions remotely...
Glances Outdated._load_cache() Code Execution
The vulnerability of the Outdated.loadcache function in the glances/outdated.py monitoring tool is related to deserialization mechanism flaws. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Glances virsh Command Execution
The vulnerability of the virsh function in the Glances/plugins/vms/engines/virsh.py module of the monitoring tool Glances is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...
Glances secure_popen Command Execution
The vulnerability of the securepopen function in the Glances monitoring tool glances/secure.py is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...
glances-common-4.5.6-1.1 on GA media (moderate)
glances-common-4.5.6-1.1 on GA media Announcement ID: openSUSE-SU-2026:11674-1 Rating: moderate Cross-References: CVE-2021-23418 CVE-2026-62982 CVE-2026-68517 CVE-2026-68518 CVE-2026-68519 CVE-2026-68520 Affected Products: openSUSE Tumbleweed An update that solves 6 vulnerabilities can now be...
SUSE CVE-2026-68517
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...
SUSE CVE-2026-68518
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...
SUSE CVE-2026-68519
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...
SUSE CVE-2026-68520
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...
PT-2026-85175
These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:11674-1 glances-common-4.5.6-1.1 on GA media
These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-68517
A flaw was found in Glances. The REST API's Cross-Origin Resource Sharing CORS protection mechanism incorrectly validates allowed origins. This vulnerability occurs because the corsorigins guard uses exact list equality instead of checking for wildcard membership. A remote attacker could exploit...
CVE-2026-68520
A flaw was found in Glances, an open-source system monitoring tool. A remote unauthenticated attacker could exploit a vulnerability in the asdictsecure function, which incorrectly handles option names. This flaw leads to the exposure of sensitive information, including usernames and credentials...
CVE-2026-68518
A flaw was found in Glances, an open-source system monitoring tool. This vulnerability allows an attacker to bypass input sanitization by using adjacent unescaped Mustache variables. When an administrator-configured action template renders attacker-controlled process or container fields, these...
CVE-2026-62982
A flaw was found in Glances, an open-source system monitoring tool. The sanitizemustachedict function in glances/actions.py did not properly sanitize nested list and dictionary strings, specifically process command-line values. This allowed pipe characters to bypass the sanitization process and b...
CVE-2026-68519
A flaw was found in Glances. This issue occurs because the --disable-config-exec option does not properly prevent on-alert action commands from executing shell operators. A local attacker with high privileges could exploit this to execute arbitrary commands, leading to high impact on...
PYSEC-2026-3665 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...