| OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action OutputCVE-2026-67439 · GHSA-JM28-2WCR-QF3HVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)CVE-2026-67437 · GHSA-XPXJ-F2FM-RQCHVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckCVE-2026-67438 · GHSA-XC5W-4V5W-7X65Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command ContaminationCVE-2026-48708 · GHSA-7FQ5-7WR8-RJWJVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input FilteringCVE-2026-53541 · GHSA-PRJ9-97MP-MWH2Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument EnumerationCVE-2026-48709 · GHSA-F637-W7P2-M7FXVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Low
|
Fix reported |
|
| OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStreamCVE-2026-32102 · GHSA-228V-WC5R-J8M7Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin's email argument makes compliance harder, enables log injectionGHSA-XX6G-43W2-9G6G · GO-2026-4687Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin has JWT Audience Validation Bypass in Local Key and HMAC ModesCVE-2026-30223 · GHSA-G962-2J28-3CG9Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin has crash on NPE by calling APIs with invalid bindings or log referencesGHSA-FWHJ-785H-43HH · GO-2026-4621Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin Session Fixation: Logout Fails to Invalidate Server-Side SessionCVE-2026-30224 · GHSA-GQ2M-77HF-VWGHVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin has Unauthenticated Action Termination via KillAction When Guests Must LoginCVE-2026-28790 · GHSA-4FQM-6FMH-82MQVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin's RestartAction always runs actions as guestCVE-2026-30225 · GHSA-P443-P7W5-2F7FVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin's unsafe parsing of UniqueTrackingId can be used to write filesCVE-2026-31817 · GHSA-364Q-W7VH-VHPCVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin doesn't check view permission when returning dashboardsCVE-2026-30233 · GHSA-JF73-858C-54PGVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Medium
|
Fix reported |
|
| OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handlingCVE-2026-28789 · GHSA-45M3-398W-M2M9Version ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointCVE-2026-28342 · GHSA-PC8G-78PF-4XRPVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
Fix reported |
|
| OliveTin OS Command Injection vulnerabilityCVE-2025-50946 · GHSA-P3QF-84RG-JXFCVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
High
|
No fix reported |
|
| OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checksCVE-2026-27626 · GHSA-49GM-HH7W-WFVFVersion ranges need review. |
github.com/OliveTin/OliveTin |
Go |
Critical
|
Fix reported |
|
