OliveTin

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

OliveTin records in CISA KEV

No OliveTin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Olivetin 11 records HIGH

Records

11 records in Olivetin · all components

TI-2026-23456 CVE-2026-30223 · GHSA-g962-2j28-3cg9

OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

HIGH 79

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00332 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260304231339-e97d8ecbd8d6 CWE-287

TI-2026-22008 CVE-2026-27626 · GHSA-49gm-hh7w-wfvf

OS command injection in OliveTin

HIGH 76

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00637 Published 2026-02-25 Fixed in 0.0.0-20260222101908-4bbd2eab1532 CWE-78

TI-2026-22985 CVE-2026-28790 · GHSA-4fqm-6fmh-82mq

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00739 Published 2026-03-05 Fixed in 3000.11.0, 0.0.0-20260302002902-d9804182eae4 CWE-284

TI-2026-22984 CVE-2026-28789 · GHSA-45m3-398w-m2m9

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-05 Fixed in 3000.10.3, 0.0.0-20260301235225-f044d90d5525c CWE-362

TI-2026-22627 CVE-2026-28342 · GHSA-pc8g-78pf-4xrp

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0075 Published 2026-03-05 Fixed in 3000.10.2, 0.0.0-20260227002407-2eb5f0ba79d4 CWE-400

TI-2026-24370 CVE-2026-31817 · GHSA-364q-w7vh-vhpc

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

HIGH 70

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00811 Published 2026-03-10 Fixed in 3000.11.2, 0.0.0-20260309102040-b03af0e2eca3 CWE-22

TI-2025-32274 CVE-2025-50946 · GHSA-p3qf-84rg-jxfc

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function…

HIGH 70

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01285 Published 2025-08-13 No fix listed CWE-78

TI-2026-23466 CVE-2026-30233 · GHSA-jf73-858c-54pg

OliveTin: View permission not being checked when returning dashboards

HIGH 68

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0046 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260305082002-d7962710e7c4 CWE-200

TI-2026-24640 CVE-2026-32102 · GHSA-228v-wc5r-j8m7

OliveTin Unauthorized Action Output Disclosure via EventStream

MEDIUM 64

OliveTin gives access to predefined shell commands from a web interface.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0049 Published 2026-03-11 Fixed in 3000.10.2 CWE-284

TI-2026-23458 CVE-2026-30225 · GHSA-p443-p7w5-2f7f

OliveTin: RestartAction always runs actions as guest

MEDIUM 63

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00457 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260305000458-cb46a597b246 CWE-250

TI-2026-23457 CVE-2026-30224 · GHSA-gq2m-77hf-vwgh

OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

MEDIUM 58

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00333 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260304233115-d6a0abc3755d15 CWE-384

Open these records in search →

Critical	1
High	8
Medium	7
Low	1
No CVSS	0