glances (PyPI)
Advisories
52
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.5.6 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "glances>=4.5.6"poetry
poetry add "glances>=4.5.6"uv
uv add "glances>=4.5.6"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-4h34-v6r8-mmjc Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config |
Medium EPSS 0.40% |
< 4.5.6 | 4.5.6 |
| GHSA-4h34-v6r8-mmjc Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config |
Medium EPSS 0.40% |
< 4.5.6 | 4.5.6 |
| GHSA-59fj-m2j6-hcxh Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) |
High EPSS 0.18% |
< 4.5.6 | 4.5.6 |
| GHSA-59fj-m2j6-hcxh Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) |
High EPSS 0.18% |
< 4.5.6 | 4.5.6 |
| GHSA-73wf-9vmv-5pv9 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection |
High EPSS 0.20% |
>= 4.5.2, < 4.5.6 | 4.5.6 |
| GHSA-73wf-9vmv-5pv9 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection |
High EPSS 0.20% |
>= 4.5.2, < 4.5.6 | 4.5.6 |
| GHSA-fp27-88fp-2phg Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard |
Medium EPSS 0.46% |
< 4.5.6 | 4.5.6 |
| GHSA-fp27-88fp-2phg Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard |
Medium EPSS 0.46% |
< 4.5.6 | 4.5.6 |
| GHSA-qcpp-8x79-hhp3 Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction |
High EPSS 0.17% |
< 4.5.6 | 4.5.6 |
| GHSA-qcpp-8x79-hhp3 Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction |
High EPSS 0.17% |
< 4.5.6 | 4.5.6 |
| GHSA-3vwc-qwhc-3mj7 Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration |
High EPSS 0.18% |
>= 4.0.8, < 4.5.5 | 4.5.5 |
| GHSA-3vwc-qwhc-3mj7 Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration |
High EPSS 0.18% |
>= 4.0.8, < 4.5.5 | 4.5.5 |
| GHSA-w856-8p3r-p338 Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack |
Medium EPSS 0.14% |
< 4.5.5 | 4.5.5 |
| GHSA-w856-8p3r-p338 Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack |
Medium EPSS 0.14% |
< 4.5.5 | 4.5.5 |
| GHSA-87qc-fj39-wccr Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) |
High EPSS 0.40% |
< 4.5.5 | 4.5.5 |
| GHSA-87qc-fj39-wccr Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) |
High EPSS 0.40% |
< 4.5.5 | 4.5.5 |
| GHSA-9837-48hr-q32j Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution |
High EPSS 0.19% |
< 4.5.5 | 4.5.5 |
| GHSA-9837-48hr-q32j Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution |
High EPSS 0.19% |
< 4.5.5 | 4.5.5 |
| GHSA-v5r2-qh84-fjx5 Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py |
High EPSS 0.19% |
< 4.5.5 | 4.5.5 |
| GHSA-v5r2-qh84-fjx5 Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py |
High EPSS 0.19% |
< 4.5.5 | 4.5.5 |
| GHSA-grp3-h8m8-45p7 Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values |
Medium EPSS 0.21% |
< 4.5.4 | 4.5.4 |
| GHSA-grp3-h8m8-45p7 Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values |
Medium EPSS 0.21% |
< 4.5.4 | 4.5.4 |
| GHSA-g5pq-48mj-jvw8 Glances has SSRF in IP Plugin via public_api leading to credential leakage |
High EPSS 0.40% |
< 4.5.4 | 4.5.4 |
| GHSA-g5pq-48mj-jvw8 Glances has SSRF in IP Plugin via public_api leading to credential leakage |
High EPSS 0.40% |
< 4.5.4 | 4.5.4 |
| GHSA-gfc2-9qmw-w7vh Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS |
Medium EPSS 0.41% |
< 4.5.4 | 4.5.4 |
| GHSA-gfc2-9qmw-w7vh Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS |
Medium EPSS 0.41% |
< 4.5.4 | 4.5.4 |
| GHSA-qhj7-v7h7-q4c7 Glances Vulnerable to Command Injection via Dynamic Configuration Values |
High EPSS 0.90% |
< 4.5.3 | 4.5.3 |
| GHSA-qhj7-v7h7-q4c7 Glances Vulnerable to Command Injection via Dynamic Configuration Values |
High EPSS 0.90% |
< 4.5.3 | 4.5.3 |
| GHSA-7p93-6934-f4q7 Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard |
Medium EPSS 0.34% |
< 4.5.3 | 4.5.3 |
| GHSA-7p93-6934-f4q7 Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard |
Medium EPSS 0.34% |
< 4.5.3 | 4.5.3 |
| GHSA-vx5f-957p-qpvm Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers |
High EPSS 0.30% |
< 4.5.2 | 4.5.2 |
| GHSA-vx5f-957p-qpvm Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers |
High EPSS 0.30% |
< 4.5.2 | 4.5.2 |
| GHSA-r297-p3v4-wp8m Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` |
Critical EPSS 0.49% |
< 4.5.2 | 4.5.2 |
| GHSA-r297-p3v4-wp8m Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` |
Critical EPSS 0.49% |
< 4.5.2 | 4.5.2 |
| GHSA-hhcg-r27j-fhv9 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding |
Medium EPSS 0.19% |
< 4.5.2 | 4.5.2 |
| GHSA-hhcg-r27j-fhv9 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding |
Medium EPSS 0.19% |
< 4.5.2 | 4.5.2 |
| GHSA-49g7-2ww7-3vf5 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements |
Critical EPSS 0.34% |
< 4.5.2 | 4.5.2 |
| GHSA-49g7-2ww7-3vf5 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements |
Critical EPSS 0.34% |
< 4.5.2 | 4.5.2 |
| GHSA-9jfm-9rc6-2hfq Glances's Default CORS Configuration Allows Cross-Origin Credential Theft |
High EPSS 0.34% |
< 4.5.2 | 4.5.2 |
| GHSA-9jfm-9rc6-2hfq Glances's Default CORS Configuration Allows Cross-Origin Credential Theft |
High EPSS 0.34% |
< 4.5.2 | 4.5.2 |
| GHSA-cvwp-r2g2-j824 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials |
High EPSS 0.51% |
< 4.5.2 | 4.5.2 |
| GHSA-cvwp-r2g2-j824 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials |
High EPSS 0.51% |
< 4.5.2 | 4.5.2 |
| GHSA-vcv2-q258-wrg7 Glances has a Command Injection via Process Names in Action Command Templates |
High EPSS 0.25% |
< 4.5.2 | 4.5.2 |
| GHSA-vcv2-q258-wrg7 Glances has a Command Injection via Process Names in Action Command Templates |
High EPSS 0.25% |
< 4.5.2 | 4.5.2 |
| GHSA-wvxv-4j8q-4wjq Glances exposes the REST API without authentication |
High EPSS 1.55% |
< 4.5.2 | 4.5.2 |
| GHSA-wvxv-4j8q-4wjq Glances exposes the REST API without authentication |
High EPSS 1.55% |
< 4.5.2 | 4.5.2 |
| GHSA-x46r-mf5g-xpr6 Glances has SQL Injection via Process Names in TimescaleDB Export |
Critical EPSS 0.38% |
< 4.5.1 | 4.5.1 |
| GHSA-x46r-mf5g-xpr6 Glances has SQL Injection via Process Names in TimescaleDB Export |
Critical EPSS 0.38% |
< 4.5.1 | 4.5.1 |
| GHSA-gh4x-f7cq-wwx6 Glances Exposes Unauthenticated Configuration Secrets |
High EPSS 1.69% |
< 4.5.1 | 4.5.1 |
| GHSA-gh4x-f7cq-wwx6 Glances Exposes Unauthenticated Configuration Secrets |
High EPSS 1.69% |
< 4.5.1 | 4.5.1 |
| GHSA-r2mj-8wgq-73m6 XML External Entity Reference in Glances |
Medium EPSS 1.65% |
< 3.2.1 | 3.2.1 |
| GHSA-r2mj-8wgq-73m6 XML External Entity Reference in Glances |
Medium EPSS 1.65% |
< 3.2.1 | 3.2.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor