Read the docs

actualbudget

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

actualbudget records in CISA KEV

No actualbudget vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Actual 4 records HIGH

Records

13 records

TI-2026-02669 CVE-2026-3089 · GHSA-27vg-33gh-4hwg

Actual Sync Server 26.2.1 - Authenticated Path Traversal

Priority MEDIUM 63

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00416 Published 2026-03-09 Fixed in 26.3.0 CWE-22
TI-2026-34329 CVE-2026-46700 · GHSA-3f62-qv96-4p78

Improper authorization in actualbudget actual

Priority MEDIUM 53

Actual is a local-first personal finance tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-07-07 Fixed in 26.6.0 CWE-285
TI-2026-31096 CVE-2026-42890 · GHSA-7rvm-xjpp-63r9

actual Allows Electron to Run As Node

Priority LOW 21

Actual is an open-source personal finance application.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00126 Published 2026-06-12 Fixed in 26.5.0 CWE-94
Open these records in search →