Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

glances

26 known vulnerabilities (1 critical, 19 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
4.5.9 (Nov 7, 2026): no advisory affects it
Newest unaffected release
4.5.9 (Nov 7, 2026), the latest release
Advisories
26 · 1 critical, 19 high, 6 medium
Weekly downloads
17.3K
Dependents
4
Releases
123 since 1.7.0 (Aug 10, 2013)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 26 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 26

  • Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

    Affected: fixed in 4.5.6.

    Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command…

    Affected: from 4.5.2, fixed in 4.5.6.

    Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2026-68520Medium 5.3

    Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

    Affected: fixed in 4.5.6.

    Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2026-68517Medium 6.5

    Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing…

    Affected: fixed in 4.5.6.

    Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

    Affected: fixed in 4.5.6.

    Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

    Affected: fixed in 4.5.5.

    Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution

    Affected: fixed in 4.5.5.

    Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

    Affected: from 4.0.8, fixed in 4.5.5.

    Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

    Affected: fixed in 4.5.5.

    Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2026-46611Medium 5.3

    Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

    Affected: fixed in 4.5.5.

    Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2026-35588Medium 6.3

    Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

    Affected: fixed in 4.5.4.

    Fixed in 4.5.4 (released Apr 19, 2026, 1 day before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances IP Plugin has SSRF via public_api that leads to credential leakage

    Affected: fixed in 4.5.4.

    Fixed in 4.5.4 (released Apr 19, 2026, 1 day before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

    Affected: fixed in 4.5.4.

    Fixed in 4.5.4 (released Apr 19, 2026, 1 day before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances Vulnerable to Command Injection via Dynamic Configuration Values

    Affected: fixed in 4.5.3.

    Fixed in 4.5.3 (released Mar 31, 2026, 2 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

    Affected: fixed in 4.5.3.

    Fixed in 4.5.3 (released Mar 31, 2026, 2 days before disclosure).

    The latest release, 4.5.9, is not affected.

Show all 26 advisoriesShow fewer advisories

  • Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2026-32633Critical 9.1

    Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2026-32632Medium 5.9

    Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances has a Command Injection via Process Names in Action Command Templates

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances exposes the REST API without authentication

    Affected: fixed in 4.5.2.

    Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances has SQL Injection via Process Names in TimescaleDB Export

    Affected: fixed in 4.5.1.

    Fixed in 4.5.1 (released Mar 7, 2026, 3 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • Glances Exposes Unauthenticated Configuration Secrets

    Affected: fixed in 4.5.1.

    Fixed in 4.5.1 (released Mar 7, 2026, 3 days before disclosure).

    The latest release, 4.5.9, is not affected.

  • CVE-2021-23418Medium 6.3

    XML External Entity (XXE) Injection

    Affected: fixed in 3.2.1.

    Fixed in 3.2.1 (released Jul 10, 2021, 19 days before disclosure).

    The latest release, 4.5.9, is not affected.