Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 1 | Disclosure1 |
| 2026-04-07 | 1 | Disclosure1 |
| 2026-06-22 | 2 | Disclosure1General1 |
🔴 Glances (XML-RPC Server), CORS Misconfiguration / Mitigation Bypass, #CVE-2026-33533 (High) -DC-Jun2026-558 https://dailycve.com/glances-xml-rpc-server-cors-misconfiguration-mitigation-bypass-cve-2026-33533-high-dc-jun2026-558/
Post summary
The post announces CVE‑2026‑33533, a CORS misconfiguration in the Glances XML‑RPC Server, but does not provide PoC, exploit, or patch details.
🔴 Glances XML-RPC Server, DNS Rebinding via Host Header Validation Bypass (#CVE-2026-33533 / #CVE-2026-32632) – High -DC-Jun2026-561 https://dailycve.com/glances-xml-rpc-server-dns-rebinding-via-host-header-validation-bypass-cve-2026-33533-cve-2026-32632-high-dc-jun2026-561/
Post summary
The post announces two high‑severity CVEs affecting the Glances XML‑RPC Server, describing a DNS rebinding via host header validation bypass. No PoC, exploit code, active exploitation, or patch details are provided.
`Glances` is vulnerable to cross-origin system information disclosure via its XML-RPC server CORS wildcard (CVE-2026-33533). Restrict network access to mitigate. #infosec #security #Glances https://www.pulsepatch.io/posts/cve-2026-33533-glances-system-information-disclosure
Post summary
The post announces CVE‑2026‑33533, describing a cross‑origin information disclosure flaw in Glances’ XML‑RPC server and advises restricting network access as a mitigation.
CVE-2026-33533 Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) se… https://www.cve.org/CVERecord?id=CVE-2026-33533
Post summary
The text is a brief disclosure of CVE-2026-33533, noting that the Glances XML-RPC server is vulnerable before version 4.5.3 and referencing the official CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nicolargo | glances | - | - | - |