Lucene search
+L

429 matches found

Nuclei
Nuclei
added 2026/08/23 2:28 a.m.38 views

Glances - Information Disclosure

Glances 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges. id: CVE-2026-32596 info: name: Glances -...

8.7CVSS7.9AI score0.0155EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.25 views

Glances - Information Disclosure

Glances 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access. id: CVE-2026-30928 info: name: Glances - Information...

8.7CVSS7.9AI score0.01657EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.6 views

Linux Distros Unpatched Vulnerability : CVE-2026-68520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes...

5.3CVSS5.5AI score0.00237EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.4 views

Linux Distros Unpatched Vulnerability : CVE-2026-68518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values...

8.8CVSS5.5AI score0.00139EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-68517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list...

6.5CVSS5.5AI score0.00256EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/17 6:18 p.m.6 views

CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

5.3CVSS0.00237EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/17 6:18 p.m.4 views

UBUNTU-CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

7.1CVSS5.5AI score0.00125EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/17 6:18 p.m.5 views

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

5.3CVSS5.3AI score0.00237EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/17 6:17 p.m.6 views

CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

8.8CVSS0.00138EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/17 6:17 p.m.6 views

UBUNTU-CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

8.8CVSS5.3AI score0.00138EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/08/17 5:20 p.m.12 views

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

5.3CVSS5.3AI score0.00237EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/17 5:20 p.m.9 views

GHSA-4H34-V6R8-MMJC Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

5.3CVSS5.4AI score0.00237EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/17 5:20 p.m.7 views

GHSA-59FJ-M2J6-HCXH Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

7.1CVSS5.6AI score0.00125EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/17 5:20 p.m.9 views

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

7.8CVSS5.5AI score0.00137EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/17 5:20 p.m.10 views

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

8.8CVSS7.4AI score0.00243EPSS
SaveExploits1References4Affected Software1
OSV
OSV
added 2026/08/17 5:20 p.m.7 views

GHSA-73WF-9VMV-5PV9 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

8.8CVSS5.9AI score0.00138EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/17 5:16 p.m.5 views

CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

6.5CVSS0.00256EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/17 5:16 p.m.7 views

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

8.8CVSS0.00139EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/17 5:16 p.m.4 views

UBUNTU-CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

6.5CVSS5.3AI score0.00256EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/17 5:16 p.m.6 views

UBUNTU-CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

8.8CVSS5.3AI score0.00139EPSS
SaveExploits0References3
Rows per page
Query Builder