actualbudget

Top products

The 8 most recently published vulnerabilities affecting actualbudget.

• CVE-2026-49229Actual: Disabled OpenID users keep access through existing session tokens8.3Jul 7, 2026
• CVE-2026-50179Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields4.2Jul 7, 2026
• CVE-2026-46700Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets4.3Jul 7, 2026
• CVE-2026-46672Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper4.6Jul 7, 2026
• CVE-2026-33318Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers8.8Apr 24, 2026
• CVE-2026-3089Actual Sync Server 26.2.1 - Authenticated Path Traversal6.5Mar 9, 2026
• CVE-2026-27638ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode7.1Feb 26, 2026
• CVE-2026-27584ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints7.5Feb 24, 2026