OOliveTin

Products

Exploited and recent CVEs

• CVE-2026-53541 Medium 4.3 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering 0.4%
• CVE-2026-67439 Medium 4.3 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output 0.4%
• CVE-2026-67438 Medium 6.6 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check 1.6%
• CVE-2026-67437 High 7.5 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) 0.6%
• CVE-2026-48709 Low 3.7 OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration 0.3%
• CVE-2026-48708 High 7.5 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination 0.4%
• CVE-2026-32102 High 7.1 OliveTin Unauthorized Action Output Disclosure via EventStream 0.5%
• CVE-2026-31817 High 8.5 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files 0.8%
• CVE-2026-30233 Medium 6.5 OliveTin: View permission not being checked when returning dashboards 0.5%
• CVE-2026-30225 Medium 5.3 OliveTin: RestartAction always runs actions as guest 0.5%
• CVE-2026-30223 High 8.8 OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes 0.3%
• CVE-2026-30224 Medium 5.4 OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session 0.3%
• CVE-2026-28790 High 7.5 OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login 0.7%
• CVE-2026-28789 High 7.5 OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling 0.5%
• CVE-2026-28342 High 7.5 OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint 0.8%
• CVE-2026-27626 Critical 10.0 OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks 0.6%