CVE-2026-46607

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5.

• CWE-502

• https://github.com/nicolargo/glances/releases/tag/v4.5.5
• https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j
• https://github.com/nicolargo/glances/security/advisories/GHSA-9837-48hr-q32j

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46600Parsing an invalid SVCB or HTTPS RR can panic when the size …7.5
• CVE-2026-46601The webp decoder can panic when processing a VP8 chunk with …7.5
• CVE-2026-46602The TIFF decoder does not set a limit on the size of tiles i…7.5
• CVE-2026-46604The TIFF decoder can panic when decoding an invalid image wi…7.5
• CVE-2026-46605Incomplete authorization by Apache ActiveMQ server before ve…4.3
• CVE-2026-46606Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-46608Glances is an open-source system cross-platform monitoring t…7.4
• CVE-2026-46609Umbraco is an ASP.NET CMS. From version 14.0.0 to before ver…4.6
• CVE-2026-4661The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sal…7.5
• CVE-2026-46611Glances is an open-source system cross-platform monitoring t…5.3
• CVE-2026-46612Fission is an open-source, Kubernetes-native serverless fram…8.8
• CVE-2026-46614Fission is an open-source, Kubernetes-native serverless fram…9.8