OliveTin

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

OliveTin records in CISA KEV

No OliveTin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Olivetin 11 records HIGH

Records

17 records

TI-2026-23456 CVE-2026-30223 · GHSA-g962-2j28-3cg9

OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

HIGH 79

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00332 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260304231339-e97d8ecbd8d6 CWE-287

TI-2026-22008 CVE-2026-27626 · GHSA-49gm-hh7w-wfvf

OS command injection in OliveTin

HIGH 76

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00637 Published 2026-02-25 Fixed in 0.0.0-20260222101908-4bbd2eab1532 CWE-78

TI-2026-47717 CVE-2026-67437 · GHSA-xpxj-f2fm-rqch

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00636 Published 2026-07-29 Fixed in 3000.17.0, 0.0.0-20260708075951-ec114e95d297 CWE-400

TI-2026-22985 CVE-2026-28790 · GHSA-4fqm-6fmh-82mq

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00739 Published 2026-03-05 Fixed in 3000.11.0, 0.0.0-20260302002902-d9804182eae4 CWE-284

TI-2026-22984 CVE-2026-28789 · GHSA-45m3-398w-m2m9

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-05 Fixed in 3000.10.3, 0.0.0-20260301235225-f044d90d5525c CWE-362

TI-2026-22627 CVE-2026-28342 · GHSA-pc8g-78pf-4xrp

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0075 Published 2026-03-05 Fixed in 3000.10.2, 0.0.0-20260227002407-2eb5f0ba79d4 CWE-400

TI-2026-24370 CVE-2026-31817 · GHSA-364q-w7vh-vhpc

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

HIGH 70

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00811 Published 2026-03-10 Fixed in 3000.11.2, 0.0.0-20260309102040-b03af0e2eca3 CWE-22

TI-2025-32274 CVE-2025-50946 · GHSA-p3qf-84rg-jxfc

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function…

HIGH 70

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01285 Published 2025-08-13 No fix listed CWE-78

TI-2026-35989 CVE-2026-48708 · GHSA-7fq5-7wr8-rjwj

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

HIGH 68

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00402 Published 2026-06-15 Fixed in 3000.13.0, 0.0.0-20260521225117-d74da9314005 CWE-362

TI-2026-23466 CVE-2026-30233 · GHSA-jf73-858c-54pg

OliveTin: View permission not being checked when returning dashboards

HIGH 68

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0046 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260305082002-d7962710e7c4 CWE-200

TI-2026-47718 CVE-2026-67438 · GHSA-xc5w-4v5w-7x65

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

MEDIUM 64

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0159 Published 2026-07-29 Fixed in 3000.17.0, 0.0.0-20260708084548-995ff79736f2 CWE-78

TI-2026-24640 CVE-2026-32102 · GHSA-228v-wc5r-j8m7

OliveTin Unauthorized Action Output Disclosure via EventStream

MEDIUM 64

OliveTin gives access to predefined shell commands from a web interface.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0049 Published 2026-03-11 Fixed in 3000.10.2 CWE-284

TI-2026-23458 CVE-2026-30225 · GHSA-p443-p7w5-2f7f

OliveTin: RestartAction always runs actions as guest

MEDIUM 63

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00457 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260305000458-cb46a597b246 CWE-250

TI-2026-23457 CVE-2026-30224 · GHSA-gq2m-77hf-vwgh

OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

MEDIUM 58

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00333 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260304233115-d6a0abc3755d15 CWE-384

TI-2026-47719 CVE-2026-67439 · GHSA-jm28-2wcr-qf3h

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

MEDIUM 53

OliveTin gives safe and simple access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00433 Published 2026-07-29 Fixed in 3000.17.0, 0.0.0-20260708085316-e421780c9885 CWE-863

TI-2026-38614 CVE-2026-53541 · GHSA-prj9-97mp-mwh2

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

MEDIUM 53

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0038 Published 2026-08-21 Fixed in 0.0.0-20260531214440-ebffd9f040f7 CWE-20

TI-2026-35990 CVE-2026-48709 · GHSA-f637-w7p2-m7fx

OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

MEDIUM 51

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00329 Published 2026-06-15 Fixed in 3000.13.0, 0.0.0-20260521230847-a3865704c854 CWE-862

Open these records in search →

Critical	1
High	8
Medium	7
Low	1
No CVSS	0