Top technology
Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
Actual
HIGH 8.8
CVE-2026-33318
Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on se…
Fix: 26.4.0+
Fix from $1,950
2026-04-24
Actual
MEDIUM 6.5
CVE-2026-3089
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation o…
Fix: 26.3.0+
Fix from $1,600
2026-03-09
Actual
HIGH 7.1
CVE-2026-27638
Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify …
Fix: 26.2.1+
Fix from $1,950
2026-02-26
Actual
HIGH 7.5
CVE-2026-27584
Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows…
Fix: 26.2.1+
Fix from $1,950
2026-02-24