# cve.now: Nicolargo

The newest entries naming Nicolargo as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-68519](https://cve.now/CVE-2026-68519.md): Glances: \`--disable-config-exec\` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) (CVSS 7.1)
- [CVE-2026-62982](https://cve.now/CVE-2026-62982.md): Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection (CVSS 8.8)
- [CVE-2026-68520](https://cve.now/CVE-2026-68520.md): Glances: as\_dict\_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config (CVSS 5.3)
- [CVE-2026-68517](https://cve.now/CVE-2026-68517.md): Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard (CVSS 6.5)
- [CVE-2026-68518](https://cve.now/CVE-2026-68518.md): Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction (CVSS 8.8)
- [CVE-2026-46608](https://cve.now/CVE-2026-46608.md): Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) (CVSS 7.4)
- [CVE-2026-46607](https://cve.now/CVE-2026-46607.md): Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution (CVSS 7.8)
- [CVE-2026-53925](https://cve.now/CVE-2026-53925.md): Glances: Arbitrary file write and command execution via \`secure\_popen\` redirection and chaining operators in AMP command configuration (CVSS 7.8)
- [CVE-2026-46606](https://cve.now/CVE-2026-46606.md): Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py (CVSS 7.8)
- [CVE-2026-46611](https://cve.now/CVE-2026-46611.md): Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack (CVSS 5.3)
- [CVE-2026-35588](https://cve.now/CVE-2026-35588.md): Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values (CVSS 6.3)
- [CVE-2026-35587](https://cve.now/CVE-2026-35587.md): Glances IP Plugin has SSRF via public\_api that leads to credential leakage (CVSS 7.3)
- [CVE-2026-34839](https://cve.now/CVE-2026-34839.md): Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS (CVSS 7.7)
- [CVE-2026-33641](https://cve.now/CVE-2026-33641.md): Glances Vulnerable to Command Injection via Dynamic Configuration Values (CVSS 7.8)
- [CVE-2026-33533](https://cve.now/CVE-2026-33533.md): Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard (CVSS 7.1)
- [CVE-2026-32634](https://cve.now/CVE-2026-32634.md): Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers (CVSS 8.1)
- [CVE-2026-32633](https://cve.now/CVE-2026-32633.md): Glances's Browser API Exposes Reusable Downstream Credentials via \`/api/4/serverslist\` (CVSS 9.1)
- [CVE-2026-32632](https://cve.now/CVE-2026-32632.md): Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding (CVSS 5.9)
- [CVE-2026-32611](https://cve.now/CVE-2026-32611.md): Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements (CVSS 7.0)
- [CVE-2026-32610](https://cve.now/CVE-2026-32610.md): Glances's Default CORS Configuration Allows Cross-Origin Credential Theft (CVSS 8.1)
- [CVE-2026-32609](https://cve.now/CVE-2026-32609.md): Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials (CVSS 7.5)
- [CVE-2026-32608](https://cve.now/CVE-2026-32608.md): Glances has a Command Injection via Process Names in Action Command Templates (CVSS 7.0)
- [CVE-2026-32596](https://cve.now/CVE-2026-32596.md): Glances exposes the REST API without authentication (CVSS 8.7)
- [CVE-2026-30930](https://cve.now/CVE-2026-30930.md): Glances has SQL Injection via Process Names in TimescaleDB Export (CVSS 7.3)
- [CVE-2026-30928](https://cve.now/CVE-2026-30928.md): Glances Exposes Unauthenticated Configuration Secrets (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nicolargo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.