https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-31817.htmlhttps://patchthecve.com/cve/CVE-2026-31817.htmlWed, 17 Jun 2026 10:34:30 +0000HIGH 8.5: OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied UniqueTrackingId field in the StartAhttps://patchthecve.com/cve/CVE-2026-30233.htmlhttps://patchthecve.com/cve/CVE-2026-30233.htmlWed, 17 Jun 2026 10:32:32 +0000MEDIUM 6.5: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be cohttps://patchthecve.com/cve/CVE-2026-30225.htmlhttps://patchthecve.com/cve/CVE-2026-30225.htmlWed, 17 Jun 2026 10:32:31 +0000MEDIUM 5.3: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internalhttps://patchthecve.com/cve/CVE-2026-30224.htmlhttps://patchthecve.com/cve/CVE-2026-30224.htmlWed, 17 Jun 2026 10:32:31 +0000MEDIUM 5.4: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). https://patchthecve.com/cve/CVE-2026-30223.htmlhttps://patchthecve.com/cve/CVE-2026-30223.htmlWed, 17 Jun 2026 10:32:30 +0000HIGH 8.8: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during thttps://patchthecve.com/cve/CVE-2026-28790.htmlhttps://patchthecve.com/cve/CVE-2026-28790.htmlWed, 17 Jun 2026 10:29:02 +0000HIGH 7.5: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but chttps://patchthecve.com/cve/CVE-2026-28789.htmlhttps://patchthecve.com/cve/CVE-2026-28789.htmlWed, 17 Jun 2026 10:29:02 +0000HIGH 7.5: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, caushttps://patchthecve.com/cve/CVE-2026-28342.htmlhttps://patchthecve.com/cve/CVE-2026-28342.htmlWed, 17 Jun 2026 10:28:27 +0000HIGH 7.5: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker chttps://patchthecve.com/cve/CVE-2026-27626.htmlhttps://patchthecve.com/cve/CVE-2026-27626.htmlWed, 17 Jun 2026 10:27:24 +0000CRITICAL 9.9: OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `password`-typed argument can inject shelhttps://patchthecve.com/cve/CVE-2025-50946.htmlhttps://patchthecve.com/cve/CVE-2025-50946.htmlWed, 17 Jun 2026 09:35:27 +0000MEDIUM 6.5: OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.