Medium
CVE-2026-68520
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 26
Reset filters
High
CVE-2026-68519
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
High
CVE-2026-68518
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
Medium
CVE-2026-68517
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
High
CVE-2026-62982
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
High
CVE-2026-46607
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
High
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
Medium
CVE-2026-35588
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
High
CVE-2026-35587
Glances has SSRF in IP Plugin via public_api leading to credential leakage
High
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
High
CVE-2026-33641
Glances Vulnerable to Command Injection via Dynamic Configuration Values
High
CVE-2026-33533
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
High
CVE-2026-32634
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Medium
CVE-2026-32632
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
High
CVE-2026-32611
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
High
CVE-2026-32610
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
High
CVE-2026-32609
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
High
CVE-2026-32608
Glances has a Command Injection via Process Names in Action Command Templates
High
CVE-2026-32596
Glances exposes the REST API without authentication
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.