# Glances v4.5.6 — Glances 4.5.6

- Product: Glances (https://whatsnew.fyi/product/glances)
- Vendor: Nicolas Hennion
- Date: 2026-08-01
- Version: v4.5.6
- Original notes: https://github.com/nicolargo/glances/releases/tag/v4.5.6
- Permalink: https://whatsnew.fyi/product/glances/releases/v4.5.6
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Alert level decided by dict ordering: a failing+slow URL is downgraded to WARNING, an unscanned URL reports CRITICAL
- **fixed** — GPU plugin duplicates card name and omits N/A for unavailable metrics in multi-GPU
- **fixed** — GPU plugin duplicates the utilisation value and paints it with the memory colour in multi-GPU
- **fixed** — IP plugin displays wrong interface: outer loop in get_ip_address() never breaks
- **fixed** — VideoCore (v3d) memory shows ~93% on Raspberry Pi 5 with gpu_mem=4M — misleading denominator from drm-total-memory
- **fixed** — CSV export: --stdout-csv data rows desync from header when network interfaces change count at runtime
- **fixed** — Glances Network plugin with mismatched schema not logging in TimescaleDB export
- **security** — Value-Level Bypass in as_dict_secure() leaks credentials in URL values via /api/4/config
- **security** — --disable-config-exec does not cover on-alert action commands
- **security** — Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
- **security** — Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values
- **security** — REST API CORS Credentials Guard uses exact-match instead of membership test

Bugs corrected:

* Alert level decided by dict ordering: a failing+slow URL is downgraded to WARNING, an unscanned URL reports CRITICAL #3632
* GPU plugin duplicates card name and omits N/A for unavailable metrics in multi-GPU #3631
* GPU plugin duplicates the utilisation value and paints it with the memory colour in multi-GPU #3630
* IP plugin displays wrong interface: outer loop in get_ip_address() never breaks #3617
* VideoCore (v3d) memory shows ~93% on Raspberry Pi 5 with gpu_mem=4M — misleading denominator from drm-total-memory #3611
* CSV export: --stdout-csv data rows desync from header when network interfaces change count at runtime #3606
* Glances Network plugin with mismatched schema not logging in TimescaleDB export #3592

Security patches:

* as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config - CVE-2026-68520
* --disable-config-exec does not cover on-alert action commands - CVE-2026-68519
* Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction - CVE-2026-68518
* Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values - CVE-2026-62982
* REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test - CVE-2026-68517

Thanks to all the contributors for this version: yogendrarau, Gabriel Changamire, Sanjay Santhanam,
William Wu, Martin Ďurana and Noa Levi.