# glances (PyPI) vulnerabilities 26 known vulnerabilities (1 critical, 19 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.5.9 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 4.5.9 (Nov 7, 2026), the latest release - Weekly downloads: 17.3K - Dependents: 4 - Releases: 123 since 1.7.0 (Aug 10, 2013) - Registry: https://pypi.org/project/glances/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-68519: 1.7.0 to 4.5.5 (4.5.6 is outside it) - CVE-2026-62982: 4.5.2 to 4.5.5 (4.5.6 is outside it) - CVE-2026-68520: 1.7.0 to 4.5.5 (4.5.6 is outside it) - CVE-2026-68517: 1.7.0 to 4.5.5 (4.5.6 is outside it) - CVE-2026-68518: 1.7.0 to 4.5.5 (4.5.6 is outside it) - CVE-2026-46608: 1.7.0 to 4.5.4 (4.5.5 is outside it) - CVE-2026-46607: 1.7.0 to 4.5.4 (4.5.5 is outside it) - CVE-2026-53925: 4.0.8 to 4.5.4 (4.5.5 is outside it) - CVE-2026-46606: 1.7.0 to 4.5.4 (4.5.5 is outside it) - CVE-2026-46611: 1.7.0 to 4.5.4 (4.5.5 is outside it) - CVE-2026-35588: 1.7.0 to 4.5.3 (4.5.4 is outside it) - CVE-2026-35587: 1.7.0 to 4.5.3 (4.5.4 is outside it) - CVE-2026-34839: 1.7.0 to 4.5.3 (4.5.4 is outside it) - CVE-2026-33641: 1.7.0 to 4.5.2 (4.5.3 is outside it) - CVE-2026-33533: 1.7.0 to 4.5.2 (4.5.3 is outside it) - CVE-2026-32634: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32633: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32632: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32611: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32610: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32609: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32608: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-32596: 1.7.0 to 4.5.1 (4.5.2 is outside it) - CVE-2026-30930: 1.7.0 to 4.5.0.5 (4.5.1 is outside it) - CVE-2026-30928: 1.7.0 to 4.5.0.5 (4.5.1 is outside it) - CVE-2021-23418: 1.7.0 to 3.2.0 (3.2.1 is outside it) ## Advisories (26) ### [CVE-2026-68519](https://cve.now/CVE-2026-68519): Glances: \`--disable-config-exec\` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) - Severity: High 7.1 - Published: Aug 17, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-62982](https://cve.now/CVE-2026-62982): Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command… - Severity: High 8.8 - Published: Aug 17, 2026 - Affected: from 4.5.2, fixed in 4.5.6. - Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-68520](https://cve.now/CVE-2026-68520): Glances: as\_dict\_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config - Severity: Medium 5.3 - Published: Aug 17, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-68517](https://cve.now/CVE-2026-68517): Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing… - Severity: Medium 6.5 - Published: Aug 17, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-68518](https://cve.now/CVE-2026-68518): Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction - Severity: High 8.8 - Published: Aug 17, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Aug 1, 2026, 16 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-46608](https://cve.now/CVE-2026-46608): Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) - Severity: High 7.4 - Published: Jun 25, 2026 - Affected: fixed in 4.5.5. - Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-46607](https://cve.now/CVE-2026-46607): Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution - Severity: High 7.8 - Published: Jun 25, 2026 - Affected: fixed in 4.5.5. - Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-53925](https://cve.now/CVE-2026-53925): Glances: Arbitrary file write and command execution via \`secure\_popen\` redirection and chaining operators in AMP command configuration - Severity: High 7.8 - Published: Jun 25, 2026 - Affected: from 4.0.8, fixed in 4.5.5. - Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-46606](https://cve.now/CVE-2026-46606): Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py - Severity: High 7.8 - Published: Jun 25, 2026 - Affected: fixed in 4.5.5. - Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-46611](https://cve.now/CVE-2026-46611): Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack - Severity: Medium 5.3 - Published: Jun 25, 2026 - Affected: fixed in 4.5.5. - Fixed in 4.5.5 (released Jun 13, 2026, 12 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-35588](https://cve.now/CVE-2026-35588): Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values - Severity: Medium 6.3 - Published: Apr 20, 2026 - Affected: fixed in 4.5.4. - Fixed in 4.5.4 (released Apr 19, 2026, 1 day before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-35587](https://cve.now/CVE-2026-35587): Glances IP Plugin has SSRF via public\_api that leads to credential leakage - Severity: High 7.3 - Published: Apr 20, 2026 - Affected: fixed in 4.5.4. - Fixed in 4.5.4 (released Apr 19, 2026, 1 day before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-34839](https://cve.now/CVE-2026-34839): Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS - Severity: High 7.7 - Published: Apr 20, 2026 - Affected: fixed in 4.5.4. - Fixed in 4.5.4 (released Apr 19, 2026, 1 day before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-33641](https://cve.now/CVE-2026-33641): Glances Vulnerable to Command Injection via Dynamic Configuration Values - Severity: High 7.8 - Published: Apr 2, 2026 - Affected: fixed in 4.5.3. - Fixed in 4.5.3 (released Mar 31, 2026, 2 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-33533](https://cve.now/CVE-2026-33533): Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard - Severity: High 7.1 - Published: Apr 2, 2026 - Affected: fixed in 4.5.3. - Fixed in 4.5.3 (released Mar 31, 2026, 2 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32634](https://cve.now/CVE-2026-32634): Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers - Severity: High 8.1 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32633](https://cve.now/CVE-2026-32633): Glances's Browser API Exposes Reusable Downstream Credentials via \`/api/4/serverslist\` - Severity: Critical 9.1 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32632](https://cve.now/CVE-2026-32632): Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding - Severity: Medium 5.9 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32611](https://cve.now/CVE-2026-32611): Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements - Severity: High 7.0 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32610](https://cve.now/CVE-2026-32610): Glances's Default CORS Configuration Allows Cross-Origin Credential Theft - Severity: High 8.1 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32609](https://cve.now/CVE-2026-32609): Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials - Severity: High 7.5 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32608](https://cve.now/CVE-2026-32608): Glances has a Command Injection via Process Names in Action Command Templates - Severity: High 7.0 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-32596](https://cve.now/CVE-2026-32596): Glances exposes the REST API without authentication - Severity: High 8.7 - Published: Mar 18, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Mar 14, 2026, 4 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-30930](https://cve.now/CVE-2026-30930): Glances has SQL Injection via Process Names in TimescaleDB Export - Severity: High 7.3 - Published: Mar 10, 2026 - Affected: fixed in 4.5.1. - Fixed in 4.5.1 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2026-30928](https://cve.now/CVE-2026-30928): Glances Exposes Unauthenticated Configuration Secrets - Severity: High 8.7 - Published: Mar 10, 2026 - Affected: fixed in 4.5.1. - Fixed in 4.5.1 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 4.5.9, is not affected. ### [CVE-2021-23418](https://cve.now/CVE-2021-23418): XML External Entity (XXE) Injection - Severity: Medium 6.3 - Published: Jul 29, 2021 - Affected: fixed in 3.2.1. - Fixed in 3.2.1 (released Jul 10, 2021, 19 days before disclosure). - The latest release, 4.5.9, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/glances Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.