GHSA-87QC-FJ39-WCCR Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Summary The Glances XML-RPC server glances -s introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE 2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: whenever corsorigins contains more than one entry. An operator who configur...

GHSA-9837-48HR-Q32J Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

Summary glances/outdated.py uses pickle.load to read a version-check cache file stored at a predictable, world-accessible path /.cache/glances/glances-version.db or $XDGCACHEHOME/glances/glances-version.db. No integrity check, signature verification, or format validation is performed before...

Deserialization of Untrusted Data

Overview Glances is an A cross-platform curses-based monitoring tool Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Outdated.loadcache process. An attacker can execute arbitrary code with the privileges of the user running the application by planting ...

GHSA-V5R2-QH84-FJX5 Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Summary The Glances KVM/QEMU monitoring engine glances/plugins/vms/engines/virsh.py passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by securepopen. securepopen is explicitly designed to interpret &&, |, and as shell operators...

Command Injection

Overview Glances is an A cross-platform curses-based monitoring tool Affected versions of this package are vulnerable to Command Injection in the securepopen process when unsanitized VM domain names from KVM/QEMU are passed directly into command templates. An attacker can execute arbitrary comman...

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Summary The Glances KVM/QEMU monitoring engine glances/plugins/vms/engines/virsh.py passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by securepopen. securepopen is explicitly designed to interpret &&, |, and as shell operators...

CVE-2026-46606

creationtimestamp| type| source ---|---|--- 2026-06-13 13:43:43+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5...

CVE-2026-46608

creationtimestamp| type| source ---|---|--- 2026-06-13 13:42:55+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr...

CVE-2026-46611

creationtimestamp| type| source ---|---|--- 2026-06-13 13:42:35+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338...

CVE-2026-53925

creationtimestamp| type| source ---|---|--- 2026-06-13 13:42:10+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7...

PT-2026-49094

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5 Description The XML-RPC server glances -s contains a misconfiguration in its Cross-Origin Resource Sharing CORS implementation. When the cors origins variable is configured with more than one entry, the system...

PT-2026-49093

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5 Description Insecure deserialization occurs in glances/outdated.py because the load cache function uses pickle.load to read a version-check cache file. This file is stored at predictable, world-accessible paths...

PT-2026-49095

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5 Description The XML-RPC server implemented in glances/server.py and started with glances -s fails to validate the HTTP Host header. This allows a DNS rebinding attack, where an attacker can bypass the same-origi...

PT-2026-49096

Name of the Vulnerable Software and Affected Versions glances affected versions not specified Description The secure popen function in glances/secure.py improperly interprets shell-like operators, specifically file redirection, | pipe, and && command chaining, within command strings. When...

The vulnerability of the Glances monitoring tool lies in the lack of protection for service data, which allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Glances monitoring tool is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized access to protected information...

The vulnerability of the application software interface of the Glances monitoring tool arises from the use of an untrusted inter-domain policy file, which allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the application programming interface of the Glances monitoring tool is related to the use of an untrusted interdomain policy file. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Central Browser mode of the Glances monitoring tool allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Central Browser mode of the Glances monitoring tool is related to a lack of mechanism for verifying the source of the data. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the GlancesServersList.get_servers_list() function in the Glances monitoring tool’s application interface allows a hacker to gain unauthorized access to protected information.

The vulnerability of the GlancesServersList.getserverslist function in the Glances monitoring tool’s application interface is related to the lack of protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the secure_popen() function in the Glances monitoring tool allows a hacker to execute arbitrary commands.

The vulnerability of the securepopen function in the Glances monitoring tool is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the web interface of the Glances monitoring tool allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Glances monitoring tool’s web interface is related to the lack of a mechanism for verifying the source of the data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...