VulnSea

glances has 24 CVEs on record. Disclosures have slowed: 5 in the last 90 days after 10 in the 90 before. The busiest recent month was March 2026 with 11. The median CVSS is 7.5 (high). None have a confirmed exploitation report. The most common weakness class is CWE-78 (4).

CVEs per month

Last 12 months, by publish date

101112010203040506070809
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
5 prev 10

Products

  • glances 24
Follow glances:RSS feedSave a search →Embed badge ↗
24
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

glances vulnerabilities

CVEs affecting glances, newest first. Open any entry for full detail, references, and exploit status.

24 CVEsRSS

CVE-2026-68517Medium· 6.5
1mo ago

Glances is an open-source system cross-platform monitoring tool

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list conta…

▾ Sunlitglances · glancesEPSS 0.33%via NVD
CVE-2026-62982High· 8.8
1mo ago

Glances is an open-source system cross-platform monitoring tool

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to…

▾ Twilightglances · glancesEPSS 0.19%via NVD
CVE-2026-68519High
1mo ago

Glances is an open-source system cross-platform monitoring tool

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enable…

▾ Twilightglances · glancesEPSS 0.18%via NVD
CVE-2026-68520Medium· 5.3
1mo ago

Glances is an open-source system cross-platform monitoring tool

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthentic…

▾ Sunlitglances · glancesEPSS 0.30%via NVD
CVE-2026-68518High
1mo ago

Glances is an open-source system cross-platform monitoring tool

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables…

▾ Twilightglances · glancesEPSS 0.19%via NVD
CVE-2026-53925High· 7.8
3mo ago

Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

▾ Twilightglances · glancesEPSS 0.18%via GHSA
CVE-2026-46606High· 7.8
3mo ago

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

▾ Twilightglances · glancesEPSS 0.21%via GHSA
CVE-2026-46607High· 7.8
3mo ago

Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

▾ Twilightglances · glancesEPSS 0.36%via GHSA
CVE-2026-46608High· 7.4
3mo ago

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

▾ Twilightglances · glancesEPSS 0.40%via GHSA
CVE-2026-46611Medium· 5.3
3mo ago

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

▾ Sunlitglances · glancesEPSS 0.17%via GHSA
CVE-2026-35588Medium· 6.3
5mo ago

Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

▾ Sunlitglances · glancesEPSS 0.21%via OSV
CVE-2026-34839Medium· 6.5
5mo ago

Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

▾ Sunlitglances · glancesEPSS 0.41%via OSV
CVE-2026-35587High· 8.8
5mo ago

Glances has SSRF in IP Plugin via public_api leading to credential leakage

Glances has SSRF in IP Plugin via public_api leading to credential leakage

▾ Twilightglances · glancesEPSS 0.40%via OSV
CVE-2026-33641High· 7.8PoC
5mo ago

Glances Vulnerable to Command Injection via Dynamic Configuration Values

Glances Vulnerable to Command Injection via Dynamic Configuration Values

▾ Midnightglances · glancesEPSS 0.87%via OSV
CVE-2026-33533High
5mo ago

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

▾ Twilightglances · glancesEPSS 0.33%via OSV
CVE-2026-32596HighPoC
6mo ago

Glances exposes the REST API without authentication

Glances exposes the REST API without authentication

▾ Midnightglances · glancesEPSS 1.6%via OSV
CVE-2026-32634High· 8.1
6mo ago

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

▾ Twilightglances · glancesEPSS 0.28%via OSV
CVE-2026-32608High· 7.0
6mo ago

Glances has a Command Injection via Process Names in Action Command Templates

Glances has a Command Injection via Process Names in Action Command Templates

▾ Twilightglances · glancesEPSS 0.24%via OSV
CVE-2026-32632Medium· 5.9
6mo ago

Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

▾ Sunlitglances · glancesEPSS 0.18%via OSV
CVE-2026-32609High· 7.5
6mo ago

Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

▾ Twilightglances · glancesEPSS 0.50%via OSV
CVE-2026-32610High· 8.1
6mo ago

Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

▾ Twilightglances · glancesEPSS 0.34%via OSV
CVE-2026-32611High· 7.0
6mo ago

Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements

Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements

▾ Twilightglances · glancesEPSS 0.33%via OSV
CVE-2026-30930High
6mo ago

Glances has SQL Injection via Process Names in TimescaleDB Export

Glances has SQL Injection via Process Names in TimescaleDB Export

▾ Twilightglances · glancesEPSS 0.36%via OSV
CVE-2026-30928HighPoC
6mo ago

Glances Exposes Unauthenticated Configuration Secrets

Glances Exposes Unauthenticated Configuration Secrets

▾ Midnightglances · glancesEPSS 1.7%via OSV
glances vulnerabilities (CVEs) · VulnSea