{"schema_version":1,"title":"glances (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 26 vulnerabilities in glances (PyPI): 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-68520, was published on 17 August 2026.","url":"https://junglewise.ai/threats/technologies/glances","json_url":"https://junglewise.ai/threats/technologies/glances.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/glances","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":11,"all_time":26,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":6,"last_365_days":25},"latest":[{"cve":"CVE-2026-68520","cvss":5.3,"epss":0.0041,"slug":"cve-2026-68520-glances-as-dict-secure-credential-leak-in-api-config-endpoint","title":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option na","severity":"medium","exploited":false,"published_at":"2026-08-17T18:18:06.753+00:00","url":"https://junglewise.ai/threats/cve-2026-68520-glances-as-dict-secure-credential-leak-in-api-config-endpoint"},{"cve":"CVE-2026-68519","cvss":4,"epss":0.0018,"slug":"cve-2026-68519-glances-incomplete-fix-in-alert-action-command-execution","title":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disabl","severity":"high","exploited":false,"published_at":"2026-08-17T18:18:06.61+00:00","url":"https://junglewise.ai/threats/cve-2026-68519-glances-incomplete-fix-in-alert-action-command-execution"},{"cve":"CVE-2026-62982","cvss":8.8,"epss":0.002,"slug":"cve-2026-62982-glances-incomplete-command-injection-sanitizer-fix-in-nested-stat","title":"Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py ski","severity":"high","exploited":false,"published_at":"2026-08-17T18:17:56.74+00:00","url":"https://junglewise.ai/threats/cve-2026-62982-glances-incomplete-command-injection-sanitizer-fix-in-nested-stat"},{"cve":"CVE-2026-68518","cvss":4,"epss":0.0017,"slug":"cve-2026-68518-glances-command-injection-via-cross-field-shell-operator","title":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes i","severity":"high","exploited":false,"published_at":"2026-08-17T17:16:40.353+00:00","url":"https://junglewise.ai/threats/cve-2026-68518-glances-command-injection-via-cross-field-shell-operator"},{"cve":"CVE-2026-68517","cvss":6.5,"epss":0.0046,"slug":"cve-2026-68517-glances-rest-api-cors-credentials-bypass-via-wildcard-in-multi","title":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_a","severity":"medium","exploited":false,"published_at":"2026-08-17T17:16:40.173+00:00","url":"https://junglewise.ai/threats/cve-2026-68517-glances-rest-api-cors-credentials-bypass-via-wildcard-in-multi"},{"cve":"CVE-2026-32633","cvss":3.1,"epss":0.0061,"slug":"cve-2026-32633-glances-s-browser-api-exposes-reusable-downstream-credentials-via","title":"PYSEC-2026-343 - Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:44.905963+00:00","url":"https://junglewise.ai/threats/cve-2026-32633-glances-s-browser-api-exposes-reusable-downstream-credentials-via"},{"cve":"CVE-2026-53925","cvss":7.8,"epss":0.0018,"slug":"cve-2026-53925-nicolargo-glances-command-injection-in-secure-popen-via-amp","title":"nicolargo Glances command injection in secure_popen via AMP configuration","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:40.017+00:00","url":"https://junglewise.ai/threats/cve-2026-53925-nicolargo-glances-command-injection-in-secure-popen-via-amp"},{"cve":"CVE-2026-46611","cvss":5.3,"epss":0.0017,"slug":"cve-2026-46611-nicolargo-glances-dns-rebinding-in-xml-rpc-server","title":"nicolargo Glances DNS rebinding in XML-RPC server","severity":"medium","exploited":false,"published_at":"2026-06-25T19:16:37.8+00:00","url":"https://junglewise.ai/threats/cve-2026-46611-nicolargo-glances-dns-rebinding-in-xml-rpc-server"},{"cve":"CVE-2026-46608","cvss":7.4,"epss":0.004,"slug":"cve-2026-46608-nicolargo-glances-cors-wildcard-fallback-in-xml-rpc-server","title":"nicolargo Glances CORS wildcard fallback in XML-RPC server","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:37.663+00:00","url":"https://junglewise.ai/threats/cve-2026-46608-nicolargo-glances-cors-wildcard-fallback-in-xml-rpc-server"},{"cve":"CVE-2026-46607","cvss":7.8,"epss":0.0036,"slug":"cve-2026-46607-nicolargo-glances-insecure-pickle-deserialization-in-version","title":"nicolargo Glances insecure pickle deserialization in version cache","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:37.527+00:00","url":"https://junglewise.ai/threats/cve-2026-46607-nicolargo-glances-insecure-pickle-deserialization-in-version"},{"cve":"CVE-2026-46606","cvss":7.8,"epss":0.0021,"slug":"cve-2026-46606-nicolargo-glances-command-injection-in-virsh-py","title":"nicolargo Glances command injection in virsh.py","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:37.38+00:00","url":"https://junglewise.ai/threats/cve-2026-46606-nicolargo-glances-command-injection-in-virsh-py"},{"cve":"CVE-2026-35588","cvss":6.3,"epss":0.0019,"slug":"cve-2026-35588-glances-has-cql-injection-in-its-cassandra-export-module-via","title":"Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values","severity":"medium","exploited":false,"published_at":"2026-04-21T15:18:58+00:00","url":"https://junglewise.ai/threats/cve-2026-35588-glances-has-cql-injection-in-its-cassandra-export-module-via"},{"cve":"CVE-2026-35587","cvss":8.8,"epss":0.0048,"slug":"cve-2026-35587-glances-has-ssrf-in-ip-plugin-via-public-api-leading-to","title":"Glances has SSRF in IP Plugin via public_api leading to credential leakage","severity":"high","exploited":false,"published_at":"2026-04-21T15:17:52+00:00","url":"https://junglewise.ai/threats/cve-2026-35587-glances-has-ssrf-in-ip-plugin-via-public-api-leading-to"},{"cve":"CVE-2026-34839","cvss":3.1,"epss":0.0047,"slug":"cve-2026-34839-glances-cross-origin-information-disclosure-via-unauthenticated","title":"PYSEC-2026-2175 - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/","severity":"low","exploited":false,"published_at":"2026-04-21T00:16:27.91+00:00","url":"https://junglewise.ai/threats/cve-2026-34839-glances-cross-origin-information-disclosure-via-unauthenticated"},{"cve":"CVE-2026-33641","cvss":7.8,"epss":0.0078,"slug":"cve-2026-33641-glances-vulnerable-to-command-injection-via-dynamic-configuration","title":"Glances Vulnerable to Command Injection via Dynamic Configuration Values","severity":"high","exploited":false,"published_at":"2026-03-30T17:01:27+00:00","url":"https://junglewise.ai/threats/cve-2026-33641-glances-vulnerable-to-command-injection-via-dynamic-configuration"},{"cve":"CVE-2026-33533","cvss":4,"epss":0.0048,"slug":"cve-2026-33533-glances-vulnerable-to-cross-origin-system-information-disclosure","title":"Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard","severity":"high","exploited":false,"published_at":"2026-03-30T17:00:54+00:00","url":"https://junglewise.ai/threats/cve-2026-33533-glances-vulnerable-to-cross-origin-system-information-disclosure"},{"cve":"CVE-2026-32634","cvss":3.1,"epss":0.0023,"slug":"cve-2026-32634-glances-central-browser-autodiscovery-leaks-reusable-credentials","title":"PYSEC-2026-2172 - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Ze","severity":"low","exploited":false,"published_at":"2026-03-18T18:16:29.097+00:00","url":"https://junglewise.ai/threats/cve-2026-32634-glances-central-browser-autodiscovery-leaks-reusable-credentials"},{"cve":"CVE-2026-32632","cvss":3.1,"epss":0.0018,"slug":"cve-2026-32632-glances-s-rest-webui-lacks-host-validation-and-remains-exposed-to","title":"PYSEC-2026-2171 - Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but p","severity":"low","exploited":false,"published_at":"2026-03-18T18:16:28.76+00:00","url":"https://junglewise.ai/threats/cve-2026-32632-glances-s-rest-webui-lacks-host-validation-and-remains-exposed-to"},{"cve":"CVE-2026-32611","cvss":3.1,"epss":0.004,"slug":"cve-2026-32611-glances-has-a-sql-injection-in-duckdb-export-via-unparameterized","title":"PYSEC-2026-2170 - Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the Timescale","severity":"low","exploited":false,"published_at":"2026-03-18T18:16:28.593+00:00","url":"https://junglewise.ai/threats/cve-2026-32611-glances-has-a-sql-injection-in-duckdb-export-via-unparameterized"},{"cve":"CVE-2026-32610","cvss":3.1,"epss":0.0049,"slug":"cve-2026-32610-glances-s-default-cors-configuration-allows-cross-origin","title":"PYSEC-2026-2169 - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a defaul","severity":"low","exploited":false,"published_at":"2026-03-18T17:16:06.947+00:00","url":"https://junglewise.ai/threats/cve-2026-32610-glances-s-default-cors-configuration-allows-cross-origin"},{"cve":"CVE-2026-32609","cvss":3.1,"epss":0.0059,"slug":"cve-2026-32609-glances-has-incomplete-secrets-redaction-api-v4-args-endpoint","title":"PYSEC-2026-2168 - Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration","severity":"low","exploited":false,"published_at":"2026-03-18T15:16:30.78+00:00","url":"https://junglewise.ai/threats/cve-2026-32609-glances-has-incomplete-secrets-redaction-api-v4-args-endpoint"},{"cve":"CVE-2026-32608","cvss":3.1,"epss":0.002,"slug":"cve-2026-32608-glances-has-a-command-injection-via-process-names-in-action","title":"PYSEC-2026-2167 - Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands","severity":"low","exploited":false,"published_at":"2026-03-18T07:16:21.447+00:00","url":"https://junglewise.ai/threats/cve-2026-32608-glances-has-a-command-injection-via-process-names-in-action"},{"cve":"CVE-2026-32596","cvss":4,"epss":0.0175,"slug":"cve-2026-32596-nicolargo-glances-missing-authentication-in-rest-api","title":"nicolargo Glances missing authentication in REST API","severity":"high","exploited":false,"published_at":"2026-03-16T16:23:56+00:00","url":"https://junglewise.ai/threats/cve-2026-32596-nicolargo-glances-missing-authentication-in-rest-api"},{"cve":"CVE-2026-30930","cvss":4,"epss":0.0041,"slug":"cve-2026-30930-glances-has-sql-injection-via-process-names-in-timescaledb-export","title":"PYSEC-2026-2165 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using","severity":"medium","exploited":false,"published_at":"2026-03-10T18:18:52.837+00:00","url":"https://junglewise.ai/threats/cve-2026-30930-glances-has-sql-injection-via-process-names-in-timescaledb-export"},{"cve":"CVE-2026-30928","cvss":4,"epss":0.0157,"slug":"cve-2026-30928-glances-exposes-unauthenticated-configuration-secrets","title":"PYSEC-2026-2164 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire pars","severity":"medium","exploited":false,"published_at":"2026-03-10T18:18:52.627+00:00","url":"https://junglewise.ai/threats/cve-2026-30928-glances-exposes-unauthenticated-configuration-secrets"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/picklescan"},{"name":"openbabel (PyPI)","slug":"openbabel","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/openbabel"},{"name":"apache-superset (PyPI)","slug":"apache-superset","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/apache-superset"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"weblate (PyPI)","slug":"weblate","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/weblate"},{"name":"mcp-atlassian (PyPI)","slug":"mcp-atlassian","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/mcp-atlassian"},{"name":"crawl4ai (PyPI)","slug":"crawl4ai","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/crawl4ai"},{"name":"moin (PyPI)","slug":"moin","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/moin"}],"technology":{"hub":true,"name":"glances (PyPI)","slug":"glances","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://nicolargo.github.io/glances/","repo_url":"https://github.com/nicolargo/glances","description":"A cross-platform system monitoring tool that displays system information through a web-based or terminal interface.","url":"https://junglewise.ai/threats/technologies/glances"},"most_severe":[{"cve":"CVE-2026-35587","cvss":8.8,"epss":0.0048,"slug":"cve-2026-35587-glances-has-ssrf-in-ip-plugin-via-public-api-leading-to","title":"Glances has SSRF in IP Plugin via public_api leading to credential leakage","severity":"high","exploited":false,"published_at":"2026-04-21T15:17:52+00:00","url":"https://junglewise.ai/threats/cve-2026-35587-glances-has-ssrf-in-ip-plugin-via-public-api-leading-to"},{"cve":"CVE-2026-62982","cvss":8.8,"epss":0.002,"slug":"cve-2026-62982-glances-incomplete-command-injection-sanitizer-fix-in-nested-stat","title":"Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py ski","severity":"high","exploited":false,"published_at":"2026-08-17T18:17:56.74+00:00","url":"https://junglewise.ai/threats/cve-2026-62982-glances-incomplete-command-injection-sanitizer-fix-in-nested-stat"},{"cve":"CVE-2026-33641","cvss":7.8,"epss":0.0078,"slug":"cve-2026-33641-glances-vulnerable-to-command-injection-via-dynamic-configuration","title":"Glances Vulnerable to Command Injection via Dynamic Configuration Values","severity":"high","exploited":false,"published_at":"2026-03-30T17:01:27+00:00","url":"https://junglewise.ai/threats/cve-2026-33641-glances-vulnerable-to-command-injection-via-dynamic-configuration"},{"cve":"CVE-2026-46607","cvss":7.8,"epss":0.0036,"slug":"cve-2026-46607-nicolargo-glances-insecure-pickle-deserialization-in-version","title":"nicolargo Glances insecure pickle deserialization in version cache","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:37.527+00:00","url":"https://junglewise.ai/threats/cve-2026-46607-nicolargo-glances-insecure-pickle-deserialization-in-version"},{"cve":"CVE-2026-46606","cvss":7.8,"epss":0.0021,"slug":"cve-2026-46606-nicolargo-glances-command-injection-in-virsh-py","title":"nicolargo Glances command injection in virsh.py","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:37.38+00:00","url":"https://junglewise.ai/threats/cve-2026-46606-nicolargo-glances-command-injection-in-virsh-py"},{"cve":"CVE-2026-53925","cvss":7.8,"epss":0.0018,"slug":"cve-2026-53925-nicolargo-glances-command-injection-in-secure-popen-via-amp","title":"nicolargo Glances command injection in secure_popen via AMP configuration","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:40.017+00:00","url":"https://junglewise.ai/threats/cve-2026-53925-nicolargo-glances-command-injection-in-secure-popen-via-amp"},{"cve":"CVE-2026-46608","cvss":7.4,"epss":0.004,"slug":"cve-2026-46608-nicolargo-glances-cors-wildcard-fallback-in-xml-rpc-server","title":"nicolargo Glances CORS wildcard fallback in XML-RPC server","severity":"high","exploited":false,"published_at":"2026-06-25T19:16:37.663+00:00","url":"https://junglewise.ai/threats/cve-2026-46608-nicolargo-glances-cors-wildcard-fallback-in-xml-rpc-server"},{"cve":"CVE-2026-32596","cvss":4,"epss":0.0175,"slug":"cve-2026-32596-nicolargo-glances-missing-authentication-in-rest-api","title":"nicolargo Glances missing authentication in REST API","severity":"high","exploited":false,"published_at":"2026-03-16T16:23:56+00:00","url":"https://junglewise.ai/threats/cve-2026-32596-nicolargo-glances-missing-authentication-in-rest-api"},{"cve":"CVE-2026-33533","cvss":4,"epss":0.0048,"slug":"cve-2026-33533-glances-vulnerable-to-cross-origin-system-information-disclosure","title":"Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard","severity":"high","exploited":false,"published_at":"2026-03-30T17:00:54+00:00","url":"https://junglewise.ai/threats/cve-2026-33533-glances-vulnerable-to-cross-origin-system-information-disclosure"},{"cve":"CVE-2026-68519","cvss":4,"epss":0.0018,"slug":"cve-2026-68519-glances-incomplete-fix-in-alert-action-command-execution","title":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disabl","severity":"high","exploited":false,"published_at":"2026-08-17T18:18:06.61+00:00","url":"https://junglewise.ai/threats/cve-2026-68519-glances-incomplete-fix-in-alert-action-command-execution"}],"generated_at":"2026-09-26T13:07:00.120236+00:00"}