{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "glances-common-4.5.5-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the glances-common-4.5.5-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11122",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11122-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46606 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46606/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46607 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46607/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46608 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46608/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46611 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46611/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53925 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53925/"
      }
    ],
    "title": "glances-common-4.5.5-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-06-25T00:00:00Z",
      "generator": {
        "date": "2026-06-25T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11122-1",
      "initial_release_date": "2026-06-25T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-25T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.5-1.1.aarch64",
                "product": {
                  "name": "glances-common-4.5.5-1.1.aarch64",
                  "product_id": "glances-common-4.5.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.5-1.1.aarch64",
                "product": {
                  "name": "python311-Glances-4.5.5-1.1.aarch64",
                  "product_id": "python311-Glances-4.5.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.5-1.1.aarch64",
                "product": {
                  "name": "python313-Glances-4.5.5-1.1.aarch64",
                  "product_id": "python313-Glances-4.5.5-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.5-1.1.aarch64",
                "product": {
                  "name": "python314-Glances-4.5.5-1.1.aarch64",
                  "product_id": "python314-Glances-4.5.5-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.5-1.1.ppc64le",
                "product": {
                  "name": "glances-common-4.5.5-1.1.ppc64le",
                  "product_id": "glances-common-4.5.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.5-1.1.ppc64le",
                "product": {
                  "name": "python311-Glances-4.5.5-1.1.ppc64le",
                  "product_id": "python311-Glances-4.5.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.5-1.1.ppc64le",
                "product": {
                  "name": "python313-Glances-4.5.5-1.1.ppc64le",
                  "product_id": "python313-Glances-4.5.5-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.5-1.1.ppc64le",
                "product": {
                  "name": "python314-Glances-4.5.5-1.1.ppc64le",
                  "product_id": "python314-Glances-4.5.5-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.5-1.1.s390x",
                "product": {
                  "name": "glances-common-4.5.5-1.1.s390x",
                  "product_id": "glances-common-4.5.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.5-1.1.s390x",
                "product": {
                  "name": "python311-Glances-4.5.5-1.1.s390x",
                  "product_id": "python311-Glances-4.5.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.5-1.1.s390x",
                "product": {
                  "name": "python313-Glances-4.5.5-1.1.s390x",
                  "product_id": "python313-Glances-4.5.5-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.5-1.1.s390x",
                "product": {
                  "name": "python314-Glances-4.5.5-1.1.s390x",
                  "product_id": "python314-Glances-4.5.5-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.5-1.1.x86_64",
                "product": {
                  "name": "glances-common-4.5.5-1.1.x86_64",
                  "product_id": "glances-common-4.5.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.5-1.1.x86_64",
                "product": {
                  "name": "python311-Glances-4.5.5-1.1.x86_64",
                  "product_id": "python311-Glances-4.5.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.5-1.1.x86_64",
                "product": {
                  "name": "python313-Glances-4.5.5-1.1.x86_64",
                  "product_id": "python313-Glances-4.5.5-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Glances-4.5.5-1.1.x86_64",
                "product": {
                  "name": "python314-Glances-4.5.5-1.1.x86_64",
                  "product_id": "python314-Glances-4.5.5-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64"
        },
        "product_reference": "glances-common-4.5.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le"
        },
        "product_reference": "glances-common-4.5.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x"
        },
        "product_reference": "glances-common-4.5.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64"
        },
        "product_reference": "glances-common-4.5.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64"
        },
        "product_reference": "python311-Glances-4.5.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le"
        },
        "product_reference": "python311-Glances-4.5.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x"
        },
        "product_reference": "python311-Glances-4.5.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64"
        },
        "product_reference": "python311-Glances-4.5.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64"
        },
        "product_reference": "python313-Glances-4.5.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le"
        },
        "product_reference": "python313-Glances-4.5.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x"
        },
        "product_reference": "python313-Glances-4.5.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64"
        },
        "product_reference": "python313-Glances-4.5.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.5-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64"
        },
        "product_reference": "python314-Glances-4.5.5-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.5-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le"
        },
        "product_reference": "python314-Glances-4.5.5-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.5-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x"
        },
        "product_reference": "python314-Glances-4.5.5-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Glances-4.5.5-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
        },
        "product_reference": "python314-Glances-4.5.5-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46606",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46606"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret \u0026\u0026, |, and \u003e as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances - commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46606",
          "url": "https://www.suse.com/security/cve/CVE-2026-46606"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268800 for CVE-2026-46606",
          "url": "https://bugzilla.suse.com/1268800"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46606"
    },
    {
      "cve": "CVE-2026-46607",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46607"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path - through any of several realistic local or container-level scenarios - can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46607",
          "url": "https://www.suse.com/security/cve/CVE-2026-46607"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268854 for CVE-2026-46607",
          "url": "https://bugzilla.suse.com/1268854"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46607"
    },
    {
      "cve": "CVE-2026-46608",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46608"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: * whenever cors_origins contains more than one entry. An operator who configures an explicit two-entry allowlist (e.g. two internal dashboard origins) intending to restrict browser access instead receives the unrestricted wildcard. A malicious web page served from any origin can issue a CORS simple request to /RPC2 and read the full system monitoring dataset without the victim\u0027s knowledge. This vulnerability is fixed in 4.5.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46608",
          "url": "https://www.suse.com/security/cve/CVE-2026-46608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268855 for CVE-2026-46608",
          "url": "https://bugzilla.suse.com/1268855"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46608"
    },
    {
      "cve": "CVE-2026-46611",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46611"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim\u0027s browser. This vulnerability is fixed in 4.5.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46611",
          "url": "https://www.suse.com/security/cve/CVE-2026-46611"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268856 for CVE-2026-46611",
          "url": "https://bugzilla.suse.com/1268856"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-46611"
    },
    {
      "cve": "CVE-2026-53925",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53925"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets \u003e (file redirection), | (pipe), and \u0026\u0026 (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via \u003e), chain arbitrary commands (via \u0026\u0026), or pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
          "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53925",
          "url": "https://www.suse.com/security/cve/CVE-2026-53925"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268984 for CVE-2026-53925",
          "url": "https://bugzilla.suse.com/1268984"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.5-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.s390x",
            "openSUSE Tumbleweed:python314-Glances-4.5.5-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-53925"
    }
  ]
}