Vulnerabilities for Glances

First version without a known vulnerability: 4.5.6

Details

• GHSA-4h34-v6r8-mmjc2026-08-17

  Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

  Fixed in: 4.5.6

• GHSA-59fj-m2j6-hcxh2026-08-17

  Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

  Fixed in: 4.5.6

• GHSA-73wf-9vmv-5pv92026-08-17

  Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

  Fixed in: 4.5.6

• GHSA-fp27-88fp-2phg2026-08-17

  Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

  Fixed in: 4.5.6

• GHSA-qcpp-8x79-hhp32026-08-17

  Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

  Fixed in: 4.5.6

• GHSA-3vwc-qwhc-3mj72026-06-23

  Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

  Fixed in: 4.5.5

• GHSA-w856-8p3r-p3382026-06-22

  Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

  Fixed in: 4.5.5

• GHSA-87qc-fj39-wccr2026-06-22

  Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

  Fixed in: 4.5.5

• GHSA-9837-48hr-q32j2026-06-22

  Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

  Fixed in: 4.5.5

• GHSA-v5r2-qh84-fjx52026-06-22

  Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

  Fixed in: 4.5.5

• GHSA-grp3-h8m8-45p72026-04-21

  Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

  Fixed in: 4.5.4

• GHSA-g5pq-48mj-jvw82026-04-21

  Glances has SSRF in IP Plugin via public_api leading to credential leakage

  Fixed in: 4.5.4

• GHSA-gfc2-9qmw-w7vh2026-04-21

  Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

  Fixed in: 4.5.4

• GHSA-qhj7-v7h7-q4c72026-03-30

  Glances Vulnerable to Command Injection via Dynamic Configuration Values

  Fixed in: 4.5.3

• GHSA-7p93-6934-f4q72026-03-30

  Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

  Fixed in: 4.5.3

• GHSA-vx5f-957p-qpvm2026-03-16

  Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

  Fixed in: 4.5.2

• GHSA-r297-p3v4-wp8m2026-03-16

  Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

  Fixed in: 4.5.2

• GHSA-hhcg-r27j-fhv92026-03-16

  Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

  Fixed in: 4.5.2

• GHSA-49g7-2ww7-3vf52026-03-16

  Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements

  Fixed in: 4.5.2

• GHSA-9jfm-9rc6-2hfq2026-03-16

  Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

  Fixed in: 4.5.2

• GHSA-cvwp-r2g2-j8242026-03-16

  Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

  Fixed in: 4.5.2

• GHSA-vcv2-q258-wrg72026-03-16

  Glances has a Command Injection via Process Names in Action Command Templates

  Fixed in: 4.5.2

• GHSA-wvxv-4j8q-4wjq2026-03-16

  Glances exposes the REST API without authentication

  Fixed in: 4.5.2

• GHSA-x46r-mf5g-xpr62026-03-09

  Glances has SQL Injection via Process Names in TimescaleDB Export

  Fixed in: 4.5.1

• GHSA-gh4x-f7cq-wwx62026-03-09

  Glances Exposes Unauthenticated Configuration Secrets

  Fixed in: 4.5.1

• GHSA-r2mj-8wgq-73m62021-08-09

  XML External Entity Reference in Glances

  Fixed in: 3.2.1, 85d5a6b4af31fcf785d5a61086cbbd166b40b07a, 9d6051be4a42f692392049fdbfc85d5dfa458b32, 4b87e979afdc06d98ed1b48da31e69eaa3a9fb94