Loading story…
The open-source monitoring tool Glances released version 4.5.6 with multiple security fixes, including remediation for CVE-2026-68518, a high-severity command injection flaw in action-template handling. The vulnerability affected versions prior to 4.5.6 and stemmed from sanitizing individual Mustache values before chevron.render(), allowing attacker-controlled process or container fields placed in administrator-configured action templates to reconstruct shell operators across adjacent variables and reach secure_popen() as injected commands.
The release also closed an earlier incomplete fix tied to CVE-2026-32608 and GHSA-73wf-9vmv-5pv9, where top-level-only sanitization could be bypassed through nested values such as process cmdline lists. A June patch added recursive sanitization for strings inside lists, tuples, and dictionaries to neutralize operators like &&, |, >>, and > before rendering, and new tests were added for nested structures and process command-line data. Glances 4.5.6 further bundled fixes for CVE-2026-68520, CVE-2026-68519, CVE-2026-62982, and CVE-2026-68517, alongside non-security bug fixes.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-68518 states it was newly received by security-advisories@github.com, documenting a command injection flaw in Glances where adjacent Mustache variables could reconstruct shell operators before execution by secure_popen(). The record links the issue to GHSA-qcpp-8x79-hhp3 and notes it was fixed in Glances 4.5.6.
The CVE record for CVE-2026-62982 was received by security-advisories@github.com, documenting that Glances 4.5.2 through 4.5.5 had an incomplete fix for CVE-2026-32608 that allowed nested values such as process cmdline data to bypass sanitization and reach secure_popen() for command injection. The record notes the issue was fixed in Glances 4.5.6 and links it to GHSA-73wf-9vmv-5pv9.
Glances version 4.5.6 was released with fixes for CVE-2026-68520, CVE-2026-68519, CVE-2026-68518, CVE-2026-62982, and CVE-2026-68517, including the nested-value sanitizer bypass issue. The release notes state that versions prior to 4.5.6 were affected by these flaws and that the release also included numerous non-security bug fixes.
A Glances commit addressed an incomplete fix for CVE-2026-32608 after maintainers found the action-template sanitizer could be bypassed by nested values such as process cmdline data, leading to OS command injection. The patch added recursive sanitization for strings inside lists, tuples, and dictionaries and introduced tests covering nested and runtime rendering cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The pgAdmin Development Team released **pgAdmin 4 v9.15** to fix multiple high-impact vulnerabilities affecting server-mode and web deployments, including **CVE-2026-7813**, **CVE-2026-7815**, and **CVE-2026-7816**. The most severe issues allowed authenticated users to cross tenant boundaries and access other users’ private objects by enumerating sequential IDs, expose sensitive connection details, and in some shared-server cases modify `passexec_cmd` so arbitrary shell commands would run when the legitimate owner next connected. PostgreSQL said the release also addresses stored XSS, local file inclusion and SSRF, unsafe deserialization that could lead to remote code execution, symlink-based path traversal, and an account-lockout bypass. Two additional flaws enabled authenticated users to reach operating system command execution through pgAdmin’s integration with PostgreSQL tooling. **CVE-2026-7815** affected the Maintenance Tool, where unsafe concatenation of JSON-controlled fields into SQL for `VACUUM`, `ANALYZE`, and `REINDEX` could be abused and, with a superuser-connected PostgreSQL role, escalated via PostgreSQL features into command execution on the database host. **CVE-2026-7816** affected the Import/Export query export feature, where unsanitized input in the underlying `psql` `\copy` metacommand could let attackers execute commands on the pgAdmin server or write arbitrary files. Version 9.15 introduces structural authorization checks, input allow lists, safer identifier handling, session-file encryption with Fernet, stricter file permissions, and a move from SHA-1 to **SHA-256** for the default session digest.
Jul 11, 2026
Red Hat released a series of **Important** security advisories for Grafana across **RHEL 8, 9, and 10** support channels, updating packages to remediate multiple vulnerabilities inherited from bundled Go components. The fixes span builds including `9.2.10-30.el8_10`, `9.0.9-12.el9_2`, `9.2.10-27.el9_4`, `10.2.6-21.el9_6`, `10.2.6-21.el9_7`, `10.2.6-24.el10_0`, and `10.2.6-25.el10_1`, with packages published for `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Red Hat said the updates address flaws such as `CVE-2026-32282`, a symlink-following issue in Go `Root.Chmod`, `CVE-2026-32283`, a denial-of-service bug in `crypto/tls` triggered by repeated TLS 1.3 key updates, and `CVE-2026-32280`, a certificate-chain building denial-of-service issue. Additional Grafana updates for newer RHEL 9.6 and RHEL 10 channels also fixed web and identity-handling issues in Go networking libraries. Red Hat identified `CVE-2026-39821` in `golang.org/x/net/idna` as a **privilege-escalation** flaw caused by incorrect Punycode label processing, alongside `CVE-2026-27136` and `CVE-2026-25681` in `golang.org/x/net/html`, which can enable **cross-site scripting** and potentially **arbitrary code execution** through HTML parsing bypasses. The latest affected Grafana builds include `10.2.6-22.el9_6` and `10.2.6-27.el10_2`, extending remediation across SAP, AUS, EUS, Extended Life Cycle, and other long-term Red Hat support streams.
Aug 20, 2026
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026