https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:50:09.896297+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07330 bdu:2026-07330 2026-10-07T02:50:09.900867+00:00 bdu:2026-07330 https://cve.radiocsirt.org/vuln/brew-glances-cve-2026-32609 BREW-glances-CVE-2026-32609 — Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials 2026-10-07T02:50:09.900901+00:00

Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.

 https://cve.radiocsirt.org/vuln/euvd-2026-276454 EUVD-2026-276454 2026-10-07T02:50:09.900938+00:00 EUVD-2026-276454 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32609 fkie_cve-2026-32609 2026-10-07T02:50:09.900953+00:00

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.

 https://cve.radiocsirt.org/vuln/ghsa-cvwp-r2g2-j824 GHSA-cvwp-r2g2-j824 — Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials 2026-10-07T02:50:09.900977+00:00

Affected: PyPI: Glances

## Summary

The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication.

## Details

The secrets exposure fix (GHSA-gh4x, commit 5d3de60) modified three config-related endpoints to use `as_dict_secure()` when no password is configured:

```python # glances/outputs/glances_restful_api.py:1168 (FIXED) args_json = self.config.as_dict() if self.args.password else self.config.as_dict_secure() ```

However, the `_api_args` and `_api_args_item` endpoints were not part of this fix and still return all arguments without any sanitization:

```python # glances/outputs/glances_restful_api.py:1222-1237 def _api_args(self): try: # Get the RAW value of the args dict # Use vars to convert namespace to dict args_json = vars(self.args) except Exception as e: raise HTTPException(status.HTTP_404_NOT_FOUND, f"Cannot get args ({str(e)})")

return GlancesJSONResponse(args_json) ```

And the item-specific endpoint:…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10415-1 openSUSE-SU-2026:10415-1 — glances-common-4.5.2-1.1 on GA media 2026-10-07T02:50:09.901034+00:00

glances-common-4.5.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2168 PYSEC-2026-2168 2026-10-07T02:50:09.901054+00:00

Affected: PyPI: glances

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32609 UBUNTU-CVE-2026-32609 2026-10-07T02:50:09.901691+00:00

Affected: Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:25.10: glances, Ubuntu:26.04:LTS: glances

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.