CVE-2026-67439 | Medium | 4.3 | 2026-07-29 | OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait… |
CVE-2026-67438 | Medium | 6.6 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellAr… |
CVE-2026-67437 | High | 7.5 | 2026-07-29 | OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2… |
CVE-2026-48709 | Low | 3.7 | 2026-06-15 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/inter… |
CVE-2026-48708 | High | 7.5 | 2026-06-15 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template… |
CVE-2026-32102 | Medium | 6.5 | 2026-03-11 | OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and… |
CVE-2026-31817 | High | 8.5 | 2026-03-10 | OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution… |
CVE-2026-30233 | Medium | 6.5 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated use… |
CVE-2026-30225 | Medium | 5.3 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in Resta… |
CVE-2026-30224 | Medium | 5.4 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user… |
CVE-2026-30223 | High | 8.8 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJw… |
CVE-2026-28790 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate runn… |
CVE-2026-28789 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists… |
CVE-2026-28342 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users… |
CVE-2026-27626 | Critical | 9.9 | 2026-02-25 | OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkS… |
CVE-2025-50946 | Medium | 6.5 | 2025-08-13 | OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go. |