OliveTin records

11 published records for vendor olivetin.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

11 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-27626Proof of concept	OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checksolivetin · olivetin · CWE-78 RCE Command injection	Critical9.9	—	0.6%	Feb 24, 2026
35Monitor	CVE-2026-30223No exploit	OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modesolivetin · olivetin · CWE-287 Auth bypass	High8.8	—	0.3%	Mar 6, 2026
34Monitor	CVE-2026-31817No exploit	OliveTin's unsafe parsing of UniqueTrackingId can be used to write filesolivetin · olivetin · CWE-22 Path traversal	High8.5	—	0.7%	Mar 10, 2026
30Monitor	CVE-2026-28342No exploit	OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpointolivetin · olivetin · CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Mar 5, 2026
30Monitor	CVE-2026-28790No exploit	OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Loginolivetin · olivetin · CWE-284 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.7%	Mar 5, 2026
30Monitor	CVE-2026-28789No exploit	OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingolivetin · olivetin · CWE-362 Pre-auth Race condition Denial of service	High7.5	—	0.4%	Mar 5, 2026
28Monitor	CVE-2026-32102No exploit	OliveTin Unauthorized Action Output Disclosure via EventStreamolivetin · olivetin · CWE-284 Broken access control (IDOR)	High7.1	—	0.4%	Mar 11, 2026
26Monitor	CVE-2025-50946Proof of concept	OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.olivetin · olivetin · CWE-78 pre-auth RCE Command injection	Medium6.5	—	1.3%	Aug 13, 2025
21Monitor	CVE-2026-30224No exploit	OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Sessionolivetin · olivetin · CWE-384 Auth bypass	Medium5.4	—	0.3%	Mar 6, 2026
17Monitor	CVE-2026-30233No exploit	OliveTin: View permission not being checked when returning dashboardsolivetin · olivetin · CWE-200 Info leak	Medium4.3	—	0.4%	Mar 6, 2026
17Monitor	CVE-2026-30225Proof of concept	OliveTin: RestartAction always runs actions as guestolivetin · olivetin · CWE-250 RCE	Medium4.3	—	0.4%	Mar 6, 2026

CVE-2026-27626
39Monitor
OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks
CriticalCVSS 9.9Proof of conceptEPSS 0%
- RCE
- Command injection
olivetin · olivetinFeb 24, 2026
CVE-2026-30223
35Monitor
OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
olivetin · olivetinMar 6, 2026
CVE-2026-31817
34Monitor
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
olivetin · olivetinMar 10, 2026
CVE-2026-28342
30Monitor
OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
olivetin · olivetinMar 5, 2026
CVE-2026-28790
30Monitor
OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login
HighCVSS 7.5No exploitEPSS 0%
olivetin · olivetinMar 5, 2026
CVE-2026-28789
30Monitor
OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling
HighCVSS 7.5No exploitEPSS 0%
olivetin · olivetinMar 5, 2026
CVE-2026-32102
28Monitor
OliveTin Unauthorized Action Output Disclosure via EventStream
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
olivetin · olivetinMar 11, 2026
CVE-2025-50946
26Monitor
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.
MediumCVSS 6.5Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
olivetin · olivetinAug 13, 2025
CVE-2026-30224
21Monitor
OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session
MediumCVSS 5.4No exploitEPSS 0%
- Auth bypass
olivetin · olivetinMar 6, 2026
CVE-2026-30233
17Monitor
OliveTin: View permission not being checked when returning dashboards
MediumCVSS 4.3No exploitEPSS 0%
- Info leak
olivetin · olivetinMar 6, 2026
CVE-2026-30225
17Monitor
OliveTin: RestartAction always runs actions as guest
MediumCVSS 4.3Proof of conceptEPSS 0%
- RCE
olivetin · olivetinMar 6, 2026