https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35588.htmlhttps://patchthecve.com/cve/CVE-2026-35588.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.3: Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A ushttps://patchthecve.com/cve/CVE-2026-35587.htmlhttps://patchthecve.com/cve/CVE-2026-35587.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.8: Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. The value of public_api is used directly in outbound HTTP https://patchthecve.com/cve/CVE-2026-34839.htmlhttps://patchthecve.com/cve/CVE-2026-34839.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`https://patchthecve.com/cve/CVE-2026-33641.htmlhttps://patchthecve.com/cve/CVE-2026-33641.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.8: Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implementedhttps://patchthecve.com/cve/CVE-2026-33533.htmlhttps://patchthecve.com/cve/CVE-2026-33533.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.5: Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an a