Olivetin vulnerabilities

Products

• Olivetin 17

Newest

• olivetin OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output CVE-2026-67439 Fix available 4.3 MediumJuly 29, 2026
• olivetin OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check CVE-2026-67438 Fix available 6.6 MediumJuly 29, 2026
• olivetin OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) CVE-2026-67437 Fix available 7.5 HighJuly 29, 2026
• olivetin OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering CVE-2026-53541 Fix available 4.3 MediumJune 24, 2026
• olivetin OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration CVE-2026-48709 Fix available 3.7 LowJune 15, 2026
• olivetin OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination CVE-2026-48708 Fix available 7.5 HighJune 15, 2026
• olivetin OliveTin Unauthorized Action Output Disclosure via EventStream CVE-2026-32102 Fix available 7.1 HighMarch 11, 2026
• olivetin OliveTin's unsafe parsing of UniqueTrackingId can be used to write files CVE-2026-31817 Fix available 8.5 HighMarch 10, 2026
• olivetin OliveTin: View permission not being checked when returning dashboards CVE-2026-30233 Fix available 6.5 MediumMarch 5, 2026
• olivetin OliveTin: RestartAction always runs actions as guest CVE-2026-30225 Public exploitFix available 5.3 MediumMarch 5, 2026
• olivetin OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session CVE-2026-30224 Fix available 5.4 MediumMarch 5, 2026
• olivetin OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes CVE-2026-30223 Fix available 8.8 HighMarch 5, 2026
• olivetin OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login CVE-2026-28790 Fix available 7.5 HighMarch 2, 2026
• olivetin OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling CVE-2026-28789 Fix available 7.5 HighMarch 2, 2026
• olivetin OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint CVE-2026-28342 Fix available 7.5 HighMarch 2, 2026
• olivetin OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks CVE-2026-27626 Public exploitFix available 10.0 CriticalFebruary 25, 2026
• olivetin OliveTin OS Command Injection vulnerability CVE-2025-50946 Public exploit 6.5 MediumAugust 13, 2025