Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-68517Medium· 6.5Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list conta…
CVE-2026-62982High· 8.8Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to…
CVE-2026-68519HighGlances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enable…
CVE-2026-68520Medium· 5.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthentic…
CVE-2026-68518HighGlances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables…
CVE-2026-53925High· 7.8Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
CVE-2026-46606High· 7.8Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
CVE-2026-46607High· 7.8Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
CVE-2026-46608High· 7.4Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
CVE-2026-46611Medium· 5.3Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
CVE-2026-35588Medium· 6.3Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
CVE-2026-34839Medium· 6.5Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
CVE-2026-35587High· 8.8Glances has SSRF in IP Plugin via public_api leading to credential leakage
CVE-2026-33641High· 7.8PoCGlances Vulnerable to Command Injection via Dynamic Configuration Values
CVE-2026-33533HighGlances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
CVE-2026-32633Critical· 9.1Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
CVE-2026-32596HighPoCGlances exposes the REST API without authentication
CVE-2026-32634High· 8.1Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
CVE-2026-32608High· 7.0Glances has a Command Injection via Process Names in Action Command Templates
CVE-2026-32632Medium· 5.9Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
CVE-2026-32609High· 7.5Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
CVE-2026-32610High· 8.1Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
CVE-2026-32611High· 7.0Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
CVE-2026-30930HighGlances has SQL Injection via Process Names in TimescaleDB Export
CVE-2026-30928HighPoCGlances Exposes Unauthenticated Configuration Secrets
The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.