Glances vs Fulcrum

Six releases since March, and all but one ship security patches. 4.5.2 alone corrected eight CVEs: CORS defaults allowing cross-origin credential theft, incomplete secrets redaction leaking password hashes and SNMP credentials through /api/v4/args, missing host validation leaving the REST API open to DNS rebinding, SQL injection in the DuckDB export, command injection through process names in action templates, and credential leakage via Zeroconf-spoofed browser autodiscovery. The pattern continues through 4.5.3, 4.5.4, 4.5.5 and 4.5.6, the last fixing a value-level bypass that leaked credentials embedded in URL config values. Alongside it, hardware coverage keeps widening — Intel and AMD GPUs, NVIDIA Jetson, Rockchip NPU and MPP, Raspberry Pi VideoCore.

This is what it looks like when a tool that grew up as a local terminal dashboard gets taken seriously as a network service. Nearly every advisory in the window comes from the same root assumption — that the REST API, XML-RPC server and autodiscovery browser are on a trusted network — and the fixes are systematically removing that assumption: authentication warnings on startup, host validation, tighter CORS, redaction that covers values as well as keys. The feature work continues in parallel and is almost entirely about reading more kinds of hardware.

The advisories have moved from transport-level exposure toward data-level leaks in specific endpoints, which suggests the remaining audit surface is the export backends and config serialisation rather than the servers themselves. Expect the next release to follow the same shape: hardware plugin additions plus another round of endpoint fixes.