actualbudget vulnerabilities
12 published CVEs name actualbudget among the affected products.
- 12Published CVEs12 of them scored
- 12Last 12 monthspublished in the last year
- 1Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
actualbudget · actual
High7.1 - CVE-2026-49229
Actual: Disabled OpenID users keep access through existing session tokens
actualbudget · actual
High8.3 - CVE-2026-50179
Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
actualbudget · actual
Medium4.2 - CVE-2026-46700
Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
actualbudget · actual
Medium4.3 - CVE-2026-46672
Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
actualbudget · actual
Medium4.6 - CVE-2026-50007
Actual: Shared users can perform owner-only file management actions
actualbudget · actual
High7.2 - CVE-2026-43872
actual-server has a path traversal vulnerability
actualbudget · actual
Medium5.3 - CVE-2026-42890
actual Allows Electron to Run As Node
actualbudget · actual
Medium4.8 - CVE-2026-42604
Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`
actualbudget · actual
Medium6.9 - CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
actualbudget · actual
High8.8