nicolargo vulnerabilities

Newest CVEs

• CVE-2026-68519

  Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

  nicolargo · glances

  High7.1
• CVE-2026-62982

  Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

  nicolargo · glances

  High8.8
• CVE-2026-68520

  Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

  nicolargo · glances

  Medium5.3
• CVE-2026-68517

  Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

  nicolargo · glances

  Medium6.5
• CVE-2026-68518

  Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

  nicolargo · glances

  High8.8
• CVE-2026-46608

  Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

  nicolargo · glances

  High7.4
• CVE-2026-46607

  Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution

  nicolargo · glances

  High7.8
• CVE-2026-53925

  Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

  nicolargo · glances

  High7.8
• CVE-2026-46606

  Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

  nicolargo · glances

  High7.8
• CVE-2026-46611

  Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

  nicolargo · glances

  Medium5.3