Sign in
Deutsch English Español Polski
Medium

XML External Entity Reference in Glances

  • Disclosed: 29.07.2021
  • Updated: 11.10.2026 11:20

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) glances < 3.2.1 3.2.1

References

CVSS score 6.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness (CWE)
CWE-611
Platform
Python (PyPI)
Package
glances
Disclosed
29.07.2021
Updated
11.10.2026 11:20

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2021-115 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-r2mj-8wgq-73m6 - CC BY 4.0

Vulnerability history: glances

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (26) in the archive
Total entries
26
First → latest
07.2021 08.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 19
  • Medium 6

Disclosures per year

Severity:
  1. XML External Entity Reference in Glances this entry
    Medium · 6.3 CVE-2021-23418 < 3.2.1 3.2.1
  2. Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
    High CVE-2026-68519 < 4.5.6 4.5.6
  3. Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
    High · 8.8 CVE-2026-62982 >= 4.5.2, < 4.5.6 4.5.6
  4. Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
    High CVE-2026-68518 < 4.5.6 4.5.6
  5. Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
    High · 7.8 CVE-2026-53925 >= 4.0.8, < 4.5.5 4.5.5
  6. Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
    High · 7.4 CVE-2026-46608 < 4.5.5 4.5.5
  7. Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
    High · 7.8 CVE-2026-46607 < 4.5.5 4.5.5
  8. Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
    High · 7.8 CVE-2026-46606 < 4.5.5 4.5.5
  9. Glances has SSRF in IP Plugin via public_api leading to credential leakage
    High · 8.8 CVE-2026-35587 < 4.5.4 4.5.4
  10. Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
    High · 6.5 CVE-2026-34839 < 4.5.4 4.5.4
  11. Glances Vulnerable to Command Injection via Dynamic Configuration Values
    High · 7.8 CVE-2026-33641 < 4.5.3 4.5.3
  12. Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
    High CVE-2026-33533 < 4.5.3 4.5.3
  13. Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
    High · 8.1 CVE-2026-32634 < 4.5.2 4.5.2
  14. Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
    Critical · 9.1 CVE-2026-32633 < 4.5.2 4.5.2
  15. Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
    High · 7.0 CVE-2026-32611 < 4.5.2 4.5.2
  16. Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
    High · 8.1 CVE-2026-32610 < 4.5.2 4.5.2
  17. Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
    High · 7.5 CVE-2026-32609 < 4.5.2 4.5.2
  18. Glances has a Command Injection via Process Names in Action Command Templates
    High · 7.0 CVE-2026-32608 < 4.5.2 4.5.2
  19. Glances exposes the REST API without authentication
    High CVE-2026-32596 < 4.5.2 4.5.2
  20. Glances has SQL Injection via Process Names in TimescaleDB Export
    High CVE-2026-30930 < 4.5.1 4.5.1
  21. Glances Exposes Unauthenticated Configuration Secrets
    High CVE-2026-30928 < 4.5.1 4.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.