Lucene search
+L

461 matches found

RedhatCVE
RedhatCVE
added 2026/08/24 1:29 p.m.5 views

CVE-2026-68517

A flaw was found in Glances. The REST API's Cross-Origin Resource Sharing CORS protection mechanism incorrectly validates allowed origins. This vulnerability occurs because the corsorigins guard uses exact list equality instead of checking for wildcard membership. A remote attacker could exploit...

6.5CVSS5.4AI score0.00256EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/24 1:29 p.m.5 views

CVE-2026-68520

A flaw was found in Glances, an open-source system monitoring tool. A remote unauthenticated attacker could exploit a vulnerability in the asdictsecure function, which incorrectly handles option names. This flaw leads to the exposure of sensitive information, including usernames and credentials...

5.3CVSS5.4AI score0.00237EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/24 1:29 p.m.6 views

CVE-2026-68518

A flaw was found in Glances, an open-source system monitoring tool. This vulnerability allows an attacker to bypass input sanitization by using adjacent unescaped Mustache variables. When an administrator-configured action template renders attacker-controlled process or container fields, these...

8.8CVSS5.6AI score0.00139EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/24 1:29 p.m.6 views

CVE-2026-62982

A flaw was found in Glances, an open-source system monitoring tool. The sanitizemustachedict function in glances/actions.py did not properly sanitize nested list and dictionary strings, specifically process command-line values. This allowed pipe characters to bypass the sanitization process and b...

8.8CVSS5.3AI score0.00138EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/24 1:29 p.m.6 views

CVE-2026-68519

A flaw was found in Glances. This issue occurs because the --disable-config-exec option does not properly prevent on-alert action commands from executing shell operators. A local attacker with high privileges could exploit this to execute arbitrary commands, leading to high impact on...

7.1CVSS6AI score0.00125EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.38 views

Glances - Information Disclosure

Glances 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges. id: CVE-2026-32596 info: name: Glances -...

8.7CVSS7.9AI score0.0155EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.26 views

Glances - Information Disclosure

Glances 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access. id: CVE-2026-30928 info: name: Glances - Information...

8.7CVSS7.9AI score0.01657EPSS
SaveExploits1References2
PyPA
PyPA
added 2026/08/19 11:56 a.m.8 views

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

SummaryGlances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

5.3CVSS5.3AI score0.00237EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/08/19 11:56 a.m.8 views

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

SummaryCVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates.The sanitizer only processes top-level stri...

8.8CVSS7.4AI score0.00243EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/08/19 11:56 a.m.9 views

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

SummaryGlances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead o...

6.5CVSS5.6AI score0.00256EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/08/19 11:56 a.m.11 views

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

SummaryThe Glances action system lets an administrator configure shell commands that runwhen a monitoring threshold is crossed. The command is a Mustache template whosevariables are filled with runtime stat fields such as a process name, a containername or a filesystem mount point. Those fields a...

8.8CVSS5.9AI score0.00139EPSS
SaveExploits0References7Affected Software1
OSV
OSV
added 2026/08/19 11:56 a.m.5 views

PYSEC-2026-3664 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

5.3CVSS5.4AI score0.00237EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/19 11:56 a.m.6 views

PYSEC-2026-3665 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

7.1CVSS5.6AI score0.00125EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/19 11:56 a.m.5 views

PYSEC-2026-3668 Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Summary The Glances action system lets an administrator configure shell commands that run when a monitoring threshold is crossed. The command is a Mustache template whose variables are filled with runtime stat fields such as a process name, a container name or a filesystem mount point. Those fiel...

8.8CVSS6AI score0.00139EPSS
SaveExploits0References7
PyPA
PyPA
added 2026/08/19 11:56 a.m.8 views

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

SummaryIn Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen frominterpreting the shell operators &&, | and in AMP command values taken from the configuration file. Thehardening was not applied to the on-alert action command path, which reads its...

7.1CVSS5.5AI score0.00125EPSS
SaveExploits0References7Affected Software1
OSV
OSV
added 2026/08/19 11:56 a.m.6 views

PYSEC-2026-3667 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...

6.5CVSS5.7AI score0.00256EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/19 11:56 a.m.6 views

PYSEC-2026-3666 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

8.8CVSS5.9AI score0.00138EPSS
SaveExploits0References7
SUSE CVE
SUSE CVE
added 2026/08/18 4:57 p.m.4 views

SUSE CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

8.8CVSS5.3AI score0.00138EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.6 views

Linux Distros Unpatched Vulnerability : CVE-2026-68520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes...

5.3CVSS5.5AI score0.00237EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.4 views

Linux Distros Unpatched Vulnerability : CVE-2026-68518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values...

8.8CVSS5.5AI score0.00139EPSS
SaveExploits0References3
Rows per page
Query Builder