Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Aug 21, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-53541 · Other software · OliveTin · reported by GitHubMedium 4.3
OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely; set as environment variables — via `buildEnv()`, with completely unvalidated values, and passed to the executed command; and included in the template context — available as `.Arguments.ot_*` in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026OliveTin gives safe and simple access to predefined shell commands from a web interface.CVE-2026-67439 · Other software · OliveTin · reported by GitHubMedium 4.3
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-67438 · Other software · OliveTin · reported by GitHubMedium 6.6
OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c command string and enabling OS command injection. This issue is fixed in version 3000.17.0.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-67437 · Other software · OliveTin · reported by GitHubHigh 7.5
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-48709 · Other software · OliveTin · reported by GitHubLow 3.7
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-48708 · Other software · OliveTin · reported by GitHubHigh 7.5
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-32102 · Other software · OliveTin · reported by GitHubHigh 7.1
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-31817 · Other software · OliveTin · reported by GitHubHigh 8.5
OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied UniqueTrackingId field in the StartAction API request. This value is not validated or sanitized before being used in a file path, allowing an attacker to use directory traversal sequences (e.g., ../../../) to write files to arbitrary locations on the filesystem. This vulnerability is fixed in 3000.11.2.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-30233 · Other software · OliveTin · reported by GitHubMedium 6.5
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-30225 · Other software · OliveTin · reported by GitHubMedium 5.3
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller’s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low‑privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-30224 · Other software · OliveTin · reported by GitHubMedium 5.4
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, resulting in a post-logout authentication bypass. This is a session management flaw that violates expected logout semantics. This issue has been patched in version 3000.11.1.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-30223 · Other software · OliveTin · reported by GitHubHigh 8.8
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-28790 · Other software · OliveTin · reported by GitHubHigh 7.5
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-28789 · Other software · OliveTin · reported by GitHubHigh 7.5
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-28342 · Other software · OliveTin · reported by GitHubHigh 7.5
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OliveTin gives access to predefined shell commands from a web interface.CVE-2026-27626 · Other software · OliveTin · reported by GitHubCritical 9.9
OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `password`-typed argument can inject shell metacharacters that execute arbitrary OS commands. A second independent vector allows unauthenticated RCE via webhook-extracted JSON values that skip type safety checks entirely before reaching `sh -c`. When exploiting vector 1, any authenticated user (registration enabled by default, `authType: none` by default) can execute arbitrary OS commands on the OliveTin host with the permissions of the OliveTin process. When exploiting vector 2, an unauthenticated attacker can achieve the same if the instance receives webhooks from external sources, which is a primary OliveTin use case. When an attacker exploits both vectors, this results in unauthenticated RCE on any OliveTin instance using Shell mode with webhook-triggered actions. As of time of publication, a patched version is not available.
- Product
- OliveTin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.CVE-2025-50946 · Other software · Olivetin · reported by MITREMedium 6.5
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.
- Product
- Olivetin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.