CVE-2026-68519High 7.1Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)0.2%
CVE-2026-62982High 8.8Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection0.2%
CVE-2026-68520Medium 5.3Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config0.4%
CVE-2026-68517Medium 6.5Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard0.5%
CVE-2026-68518High 8.8Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction0.2%
CVE-2026-46608High 7.4Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)0.4%
CVE-2026-46607High 7.8Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution0.2%
CVE-2026-53925High 7.8Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration0.2%
CVE-2026-46606High 7.8Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py0.2%
CVE-2026-46611Medium 5.3Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack0.1%
CVE-2026-35588Medium 6.3Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values0.2%
CVE-2026-35587High 7.3Glances IP Plugin has SSRF via public_api that leads to credential leakage0.4%
CVE-2026-34839High 7.7Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS0.4%
CVE-2026-33641High 7.8Glances Vulnerable to Command Injection via Dynamic Configuration Values0.9%
CVE-2026-33533High 7.1Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard0.3%
CVE-2026-32634High 8.1Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers0.3%
CVE-2026-32633Critical 9.1Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`0.5%
CVE-2026-32632Medium 5.9Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding0.2%
CVE-2026-32611High 7.0Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements0.3%
CVE-2026-32610High 8.1Glances's Default CORS Configuration Allows Cross-Origin Credential Theft0.4%
CVE-2026-32609High 7.5Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials0.5%
CVE-2026-32608High 7.0Glances has a Command Injection via Process Names in Action Command Templates0.3%
CVE-2026-32596High 8.7Glances exposes the REST API without authentication1.6%
CVE-2026-30930High 7.3Glances has SQL Injection via Process Names in TimescaleDB Export0.4%