OPENSUSE-SU-2026:11674-1 - Vulnerability-Lookup

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:11674-1

Vulnerability from csaf_opensuse - Published: 2026-09-02 00:00 - Updated: 2026-09-17 17:22

Summary

glances-common-4.5.6-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: glances-common-4.5.6-1.1 on GA media

Description of the patch: These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11674

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

CVE-2021-23418

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products

Product	Identifier	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x		—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64		—	Vendor Fix

Threats

Impact critical

CVE-2026-62982

Affected products

Recommended 12 products, the same list as for CVE-2021-23418

Threats

Impact important

CVE-2026-68517

Affected products

Recommended 12 products, the same list as for CVE-2021-23418

Threats

Impact moderate

CVE-2026-68518

Affected products

Recommended 12 products, the same list as for CVE-2021-23418

Threats

Impact important

CVE-2026-68519

Affected products

Recommended 12 products, the same list as for CVE-2021-23418

Threats

Impact important

CVE-2026-68520

Affected products

Recommended 12 products, the same list as for CVE-2021-23418

Threats

Impact moderate

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2021-23418/	self
https://www.suse.com/security/cve/CVE-2026-62982/	self
https://www.suse.com/security/cve/CVE-2026-68517/	self
https://www.suse.com/security/cve/CVE-2026-68518/	self
https://www.suse.com/security/cve/CVE-2026-68519/	self
https://www.suse.com/security/cve/CVE-2026-68520/	self
https://www.suse.com/security/cve/CVE-2021-23418	external
https://bugzilla.suse.com/1188925	external
https://www.suse.com/security/cve/CVE-2026-62982	external
https://bugzilla.suse.com/1275465	external
https://www.suse.com/security/cve/CVE-2026-68517	external
https://www.suse.com/security/cve/CVE-2026-68518	external
https://www.suse.com/security/cve/CVE-2026-68519	external
https://www.suse.com/security/cve/CVE-2026-68520	external

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "glances-common-4.5.6-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11674",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11674-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-23418 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-23418/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-62982 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-62982/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68517 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68517/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68518 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68518/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68519 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68519/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68520 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68520/"
      }
    ],
    "title": "glances-common-4.5.6-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T17:22:40Z",
      "generator": {
        "date": "2026-09-02T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11674-1",
      "initial_release_date": "2026-09-02T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-02T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:26:53Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:28:58Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:22:40Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-0:4.5.6-1.1.aarch64",
                "product": {
                  "name": "glances-common-0:4.5.6-1.1.aarch64",
                  "product_id": "glances-common-0:4.5.6-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/glances-common@4.5.6-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-0:4.5.6-1.1.aarch64",
                "product": {
                  "name": "python313-Glances-0:4.5.6-1.1.aarch64",
                  "product_id": "python313-Glances-0:4.5.6-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Glances@4.5.6-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-0:4.5.6-1.1.aarch64",
                "product": {
                  "name": "python314-Glances-0:4.5.6-1.1.aarch64",
                  "product_id": "python314-Glances-0:4.5.6-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Glances@4.5.6-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-0:4.5.6-1.1.ppc64le",
                "product": {
                  "name": "glances-common-0:4.5.6-1.1.ppc64le",
                  "product_id": "glances-common-0:4.5.6-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/glances-common@4.5.6-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-0:4.5.6-1.1.ppc64le",
                "product": {
                  "name": "python313-Glances-0:4.5.6-1.1.ppc64le",
                  "product_id": "python313-Glances-0:4.5.6-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Glances@4.5.6-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-0:4.5.6-1.1.ppc64le",
                "product": {
                  "name": "python314-Glances-0:4.5.6-1.1.ppc64le",
                  "product_id": "python314-Glances-0:4.5.6-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Glances@4.5.6-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-0:4.5.6-1.1.s390x",
                "product": {
                  "name": "glances-common-0:4.5.6-1.1.s390x",
                  "product_id": "glances-common-0:4.5.6-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/glances-common@4.5.6-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-0:4.5.6-1.1.s390x",
                "product": {
                  "name": "python313-Glances-0:4.5.6-1.1.s390x",
                  "product_id": "python313-Glances-0:4.5.6-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Glances@4.5.6-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-0:4.5.6-1.1.s390x",
                "product": {
                  "name": "python314-Glances-0:4.5.6-1.1.s390x",
                  "product_id": "python314-Glances-0:4.5.6-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Glances@4.5.6-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-0:4.5.6-1.1.x86_64",
                "product": {
                  "name": "glances-common-0:4.5.6-1.1.x86_64",
                  "product_id": "glances-common-0:4.5.6-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/glances-common@4.5.6-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-0:4.5.6-1.1.x86_64",
                "product": {
                  "name": "python313-Glances-0:4.5.6-1.1.x86_64",
                  "product_id": "python313-Glances-0:4.5.6-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Glances@4.5.6-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-0:4.5.6-1.1.x86_64",
                "product": {
                  "name": "python314-Glances-0:4.5.6-1.1.x86_64",
                  "product_id": "python314-Glances-0:4.5.6-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Glances@4.5.6-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-0:4.5.6-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64"
        },
        "product_reference": "glances-common-0:4.5.6-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-0:4.5.6-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le"
        },
        "product_reference": "glances-common-0:4.5.6-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-0:4.5.6-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x"
        },
        "product_reference": "glances-common-0:4.5.6-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-0:4.5.6-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64"
        },
        "product_reference": "glances-common-0:4.5.6-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-0:4.5.6-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64"
        },
        "product_reference": "python313-Glances-0:4.5.6-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-0:4.5.6-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le"
        },
        "product_reference": "python313-Glances-0:4.5.6-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-0:4.5.6-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x"
        },
        "product_reference": "python313-Glances-0:4.5.6-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-0:4.5.6-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64"
        },
        "product_reference": "python313-Glances-0:4.5.6-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-0:4.5.6-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64"
        },
        "product_reference": "python314-Glances-0:4.5.6-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-0:4.5.6-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le"
        },
        "product_reference": "python314-Glances-0:4.5.6-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-0:4.5.6-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x"
        },
        "product_reference": "python314-Glances-0:4.5.6-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-0:4.5.6-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        },
        "product_reference": "python314-Glances-0:4.5.6-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-23418",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-23418"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-23418",
          "url": "https://www.suse.com/security/cve/CVE-2021-23418"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188925 for CVE-2021-23418",
          "url": "https://bugzilla.suse.com/1188925"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-02T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2021-23418"
    },
    {
      "cve": "CVE-2026-62982",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-62982"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-62982",
          "url": "https://www.suse.com/security/cve/CVE-2026-62982"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275465 for CVE-2026-62982",
          "url": "https://bugzilla.suse.com/1275465"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-62982"
    },
    {
      "cve": "CVE-2026-68517",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68517"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68517",
          "url": "https://www.suse.com/security/cve/CVE-2026-68517"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-68517"
    },
    {
      "cve": "CVE-2026-68518",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68518"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68518",
          "url": "https://www.suse.com/security/cve/CVE-2026-68518"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-68518"
    },
    {
      "cve": "CVE-2026-68519",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68519"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68519",
          "url": "https://www.suse.com/security/cve/CVE-2026-68519"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-68519"
    },
    {
      "cve": "CVE-2026-68520",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68520"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68520",
          "url": "https://www.suse.com/security/cve/CVE-2026-68520"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-0:4.5.6-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-0:4.5.6-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-68520"
    }
  ]
}

CVE-2021-23418 (GCVE-0-2021-23418)

Vulnerability from cvelistv5 – Published: 2021-07-29 17:50 – Updated: 2024-09-16 17:38

Title

XML External Entity (XXE) Injection

Summary

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE

XML External Entity (XXE) Injection

Assigner

snyk mitre root

References

5 references

URL	Tags
https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807	x_refsource_MISC
https://github.com/nicolargo/glances/commit/4b87e…	x_refsource_MISC
https://github.com/nicolargo/glances/commit/85d5a…	x_refsource_MISC
https://github.com/nicolargo/glances/issues/1025	x_refsource_MISC
https://github.com/nicolargo/glances/commit/9d605…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Glances	Affected: unspecified , < 3.2.1 (custom)

Date Public

2021-07-29 00:00

Credits

Unknown

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:55.976Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolargo/glances/issues/1025"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Glances",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "3.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Unknown"
        }
      ],
      "datePublic": "2021-07-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML External Entity (XXE) Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-29T17:50:12.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/issues/1025"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32"
        }
      ],
      "title": "XML External Entity (XXE) Injection",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2021-07-29T17:45:15.560277Z",
          "ID": "CVE-2021-23418",
          "STATE": "PUBLIC",
          "TITLE": "XML External Entity (XXE) Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Glances",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Unknown"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "XML External Entity (XXE) Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807"
            },
            {
              "name": "https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94",
              "refsource": "MISC",
              "url": "https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94"
            },
            {
              "name": "https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a",
              "refsource": "MISC",
              "url": "https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a"
            },
            {
              "name": "https://github.com/nicolargo/glances/issues/1025",
              "refsource": "MISC",
              "url": "https://github.com/nicolargo/glances/issues/1025"
            },
            {
              "name": "https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32",
              "refsource": "MISC",
              "url": "https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23418",
    "datePublished": "2021-07-29T17:50:12.851Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:38:39.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-62982 (GCVE-0-2026-62982)

Vulnerability from cvelistv5 – Published: 2026-08-17 17:07 – Updated: 2026-08-17 18:53

Title

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 18:53 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nicolargo/glances/security/adv…	x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/ea4cf…	x_refsource_MISC
https://github.com/nicolargo/glances/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nicolargo	glances	Affected: >= 4.5.2, < 4.5.6

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62982",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T18:53:04.502222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T18:53:15.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-73wf-9vmv-5pv9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glances",
          "vendor": "nicolargo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.5.2, \u003c 4.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T17:07:49.364Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-73wf-9vmv-5pv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-73wf-9vmv-5pv9"
        },
        {
          "name": "https://github.com/nicolargo/glances/commit/ea4cf2f54f0d961e24aa0b24fff9584bab39db93",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/ea4cf2f54f0d961e24aa0b24fff9584bab39db93"
        },
        {
          "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-73wf-9vmv-5pv9",
        "discovery": "UNKNOWN"
      },
      "title": "Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process \u0027cmdline\u0027) \u2192 OS command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62982",
    "datePublished": "2026-08-17T17:07:49.364Z",
    "dateReserved": "2026-07-14T22:48:09.781Z",
    "dateUpdated": "2026-08-17T18:53:15.749Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68517 (GCVE-0-2026-68517)

Vulnerability from cvelistv5 – Published: 2026-08-17 17:03 – Updated: 2026-08-18 14:48

Title

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 14:47 UTC

CWE

CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nicolargo/glances/security/adv…	x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/89085…	x_refsource_MISC
https://github.com/nicolargo/glances/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nicolargo	glances	Affected: < 4.5.6

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68517",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T14:47:59.355003Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T14:48:25.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glances",
          "vendor": "nicolargo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T17:03:23.346Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg"
        },
        {
          "name": "https://github.com/nicolargo/glances/commit/890858944ab9d03730ec6b1ba42d4015e6d85db5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/890858944ab9d03730ec6b1ba42d4015e6d85db5"
        },
        {
          "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-fp27-88fp-2phg",
        "discovery": "UNKNOWN"
      },
      "title": "Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test \u2014 Bypassed by Any Multi-Origin Allowlist Containing the Wildcard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68517",
    "datePublished": "2026-08-17T17:03:23.346Z",
    "dateReserved": "2026-07-30T16:19:08.082Z",
    "dateUpdated": "2026-08-18T14:48:25.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68518 (GCVE-0-2026-68518)

Vulnerability from cvelistv5 – Published: 2026-08-17 16:18 – Updated: 2026-08-17 19:37

Title

Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 19:37 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nicolargo/glances/security/adv…	x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/9c280…	x_refsource_MISC
https://github.com/nicolargo/glances/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nicolargo	glances	Affected: < 4.5.6

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68518",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T19:37:09.485314Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T19:37:48.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glances",
          "vendor": "nicolargo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T16:18:29.391Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-qcpp-8x79-hhp3"
        },
        {
          "name": "https://github.com/nicolargo/glances/commit/9c280eae5419da680827024b60f6265956e31994",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/9c280eae5419da680827024b60f6265956e31994"
        },
        {
          "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-qcpp-8x79-hhp3",
        "discovery": "UNKNOWN"
      },
      "title": "Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68518",
    "datePublished": "2026-08-17T16:18:29.391Z",
    "dateReserved": "2026-07-30T16:19:08.082Z",
    "dateUpdated": "2026-08-17T19:37:48.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68519 (GCVE-0-2026-68519)

Vulnerability from cvelistv5 – Published: 2026-08-17 17:10 – Updated: 2026-08-17 17:30

Title

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 17:29 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nicolargo/glances/security/adv…	x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/5c07c…	x_refsource_MISC
https://github.com/nicolargo/glances/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nicolargo	glances	Affected: < 4.5.6

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68519",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T17:29:59.012839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T17:30:32.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glances",
          "vendor": "nicolargo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T17:10:25.951Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh"
        },
        {
          "name": "https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd"
        },
        {
          "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-59fj-m2j6-hcxh",
        "discovery": "UNKNOWN"
      },
      "title": "Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68519",
    "datePublished": "2026-08-17T17:10:25.951Z",
    "dateReserved": "2026-07-30T16:19:08.082Z",
    "dateUpdated": "2026-08-17T17:30:32.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68520 (GCVE-0-2026-68520)

Vulnerability from cvelistv5 – Published: 2026-08-17 17:06 – Updated: 2026-08-17 19:36

Title

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 19:35 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/nicolargo/glances/security/adv…	x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/8d0f8…	x_refsource_MISC
https://github.com/nicolargo/glances/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nicolargo	glances	Affected: < 4.5.6

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68520",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T19:35:46.469131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T19:36:26.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-4h34-v6r8-mmjc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "glances",
          "vendor": "nicolargo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T17:06:06.446Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-4h34-v6r8-mmjc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-4h34-v6r8-mmjc"
        },
        {
          "name": "https://github.com/nicolargo/glances/commit/8d0f8276c2abd2e9d400bd6c84bdfba0dfcab065",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/commit/8d0f8276c2abd2e9d400bd6c84bdfba0dfcab065"
        },
        {
          "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-4h34-v6r8-mmjc",
        "discovery": "UNKNOWN"
      },
      "title": "Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68520",
    "datePublished": "2026-08-17T17:06:06.446Z",
    "dateReserved": "2026-07-30T16:19:08.082Z",
    "dateUpdated": "2026-08-17T19:36:26.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.