Nicolargo

Glances

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2026-32634

Exploit
  • EPSS 0.28%
  • Veröffentlicht 18.03.2026 17:55:30
  • Zuletzt bearbeitet 19.03.2026 19:03:47

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection U...

9.1

CVE-2026-32633

Exploit
  • EPSS 0.47%
  • Veröffentlicht 18.03.2026 17:53:11
  • Zuletzt bearbeitet 19.03.2026 19:04:46

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-...

5.9

CVE-2026-32632

Exploit
  • EPSS 0.16%
  • Veröffentlicht 18.03.2026 17:47:25
  • Zuletzt bearbeitet 19.03.2026 19:06:36

Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does...

9.1

CVE-2026-32611

Exploit
  • EPSS 0.33%
  • Veröffentlicht 18.03.2026 17:21:18
  • Zuletzt bearbeitet 19.03.2026 19:11:13

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable ob...

8.1

CVE-2026-32610

Exploit
  • EPSS 0.34%
  • Veröffentlicht 18.03.2026 16:31:12
  • Zuletzt bearbeitet 21.03.2026 00:16:56

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of thes...

7.5

CVE-2026-32609

Exploit
  • EPSS 0.5%
  • Veröffentlicht 18.03.2026 14:30:37
  • Zuletzt bearbeitet 19.03.2026 14:55:31

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `...

7

CVE-2026-32608

Exploit
  • EPSS 0.24%
  • Veröffentlicht 18.03.2026 06:03:22
  • Zuletzt bearbeitet 18.03.2026 18:27:43

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g...

7.5

CVE-2026-32596

Exploit
  • EPSS 1.55%
  • Veröffentlicht 18.03.2026 05:18:11
  • Zuletzt bearbeitet 18.03.2026 18:33:12

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-l...

9.8

CVE-2026-30930

Exploit
  • EPSS 0.36%
  • Veröffentlicht 10.03.2026 16:16:59
  • Zuletzt bearbeitet 29.04.2026 01:00:01

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in si...

7.5

CVE-2026-30928

Exploit
  • EPSS 1.66%
  • Veröffentlicht 10.03.2026 16:15:37
  • Zuletzt bearbeitet 17.03.2026 16:20:29

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. ...