Release history
glances releases
Glances an Eye on your system. A top/htop alternative for GNU/Linux, BSD, Mac OS and Windows operating systems.
All releases
6 shown
v4.5.4
Security relevant
Security fixes
- SSRF in IP Plugin via public_api leading to credential leakage (CVE-2026-35587)
- Cross-Origin Information Disclosure via unauthenticated REST API /api/4 (CVE-2026-34839)
- CQL injection prevention in Cassandra plugin (CVE-2026-35588)
Notable features
- Rockchip MPP hardware encoder/decoder monitoring plugin
- Single-core Rockchip NPU load parsing support
- Fixed LXC memory percentage display issues
Full changelog
Bug corrected:
- Cannot set warning/critical temperature for a specific sensor #3525
- Memory percentage and used displayed as negative numbers #3358
- Incorrect Docker container count via Homeassistant Integration #3433
- Fix LXD filter excluding containers on standalone hosts #3529
Enhancements:
- Add Rockchip MPP plugin for hardware encoder/decoder monitoring #3514
- Clamp memory used/percent to non-negative values for LXC containers #3505
- Support single-core Rockchip NPU load parsing and improve device naming #3499
Security patches:
- SSRF in Glances IP Plugin via public_api leads to credential leakage - Correct CVE-2026-35587
- Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) - Correct CVE-2026-34839
- fix(cassandra): validate keyspace/table/replication_factor to prevent CQL injection - Correct CVE-2026-35588 #3520
Continious integration and documentation:
- pycache file is put in wheel #3516
- Remove dead code #3507
Thanks to all the contributors for this version: csvke, Christian Rishøj,
duriantaco, Julio César Suástegui, Paul and morimori-dev.
v4.5.3
Security relevant
Security fixes
- CVE-2026-33641: Command Injection via Dynamic Configuration Values
- CVE-2026-33533: Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Notable features
- LXC/LXD container support
- ClickHouse export functionality
v4.5.2
Security relevant
Breaking changes
- Host header validation enforced; requests not matching localhost/127.0.0.1 rejected unless allowed_hosts configured
- CORS policy restrictive; wildcard removed, must explicitly configure cors_origins
- Sensitive fields redacted on unauthenticated API responses; must authenticate to access password hashes and SNMP credentials
Security fixes
- CVE-2026-32610: Default CORS Configuration Allows Cross-Origin Credential Theft
- CVE-2026-32609: Incomplete Secrets Redaction in /api/v4/args Endpoint
- CVE-2026-32632: REST/WebUI DNS Rebinding Vulnerability
v4.5.1
Bug fix
Notable features
- Intel GPU monitoring support
- Docker container health alerting
- Per-plugin min/max/mean statistics
v4.5.0
New feature
Security fixes
- Fixed Jinja2 vulnerability (B701)
- Fixed timeout vulnerability (B113)
Notable features
- ZFS and NPU filesystem monitoring with NVMe support
- DuckDB export for database integration
- API token authentication for REST API security