How many CVEs does actual-app have?

actual-app has 8 published CVE records since 2026, including 8 in the last two years.

How many actual-app CVEs are in CISA KEV?

None of actual-app's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which actual-app products have the most CVEs?

The actual-app products with the most published CVEs are @actual-app/sync-server, @actual-app/cli, @actual-app/web.

What are the most common weakness types in actual-app CVEs?

actual-app's CVEs most often map to these CWE weakness types: CWE-1236 (Improper Neutralization of Formula Elements in a CSV File), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-284 (Improper Access Control), CWE-285 (Improper Authorization).

Are there public exploits for actual-app vulnerabilities?

Yes — 7 of actual-app's CVEs have a known public exploit.

How many critical actual-app vulnerabilities are there?

actual-app has 1 critical and 2 high-severity CVEs.

What is the average severity of actual-app CVEs?

The average CVSS base score across actual-app's scored CVEs is 6.1.

RadicalNotion.AI

Log in Start free

8 CVEs

actual-app Vulnerabilities

Name: actual-app vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for actual-app.

8

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

7

Public exploits

PoC or exploit code

6.1

Avg CVSS

2026–2026

Overview

actual-app has 8 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 7 have a known public exploit. The average CVSS base score across scored CVEs is 6.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting actual-app products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on actual-app's vulnerability posture, as a share of its 8 published CVEs.

Average CVSS: 6.1
Critical / high: 38%
Actively exploited (KEV): 0%
Public exploit available: 88%
Patch available: 100%

Severity and exploitation

How the CVSS severity of actual-app's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High2

Medium5

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of actual-app's CVEs are currently listed in CISA's KEV catalog.

Public exploits

7

7 of actual-app's CVEs have a known public exploit available.

Most affected products

The actual-app products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in actual-app CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish actual-app CVE records.

Latest actual-app CVEs

The most recently disclosed vulnerabilities affecting actual-app.

Actual: Disabled OpenID users keep access through existing session tokens
CWE-613
High · CVSS 8.3
EPSS 0.3%2026-07-07
Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
CWE-1236
Medium · CVSS 4.2
EPSS 0.2%2026-07-07
Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
CWE-285
Medium · CVSS 4.3
EPSS 0.2%2026-07-07
Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
CWE-1236
Medium · CVSS 4.6
EPSS 0.1%2026-07-07
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
CWE-284
High · CVSS 7.4
EPSS 0.5%2026-04-24
Actual Sync Server 26.2.1 - Authenticated Path Traversal
CWE-22
Medium · CVSS 5.3
EPSS 0.4%2026-03-09
ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
CWE-862
Medium · CVSS 5.7
EPSS 0.3%2026-02-26
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
CWE-306
Critical · CVSS 9.2
EPSS 0.4%2026-02-24

Track new actual-app CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor actual-app CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,031 CVEs linux22,545 CVEs Google16,147 CVEs Apple15,069 CVEs Oracle12,706 CVEs Debian10,225 CVEs IBM8,823 CVEs Red Hat8,067 CVEs

Browse all vendors

Frequently asked questions

Common questions about actual-app vulnerabilities.

How many CVEs does actual-app have?: actual-app has 8 published CVE records since 2026, including 8 in the last two years.
How many actual-app CVEs are in CISA KEV?: None of actual-app's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which actual-app products have the most CVEs?: The actual-app products with the most published CVEs are @actual-app/sync-server, @actual-app/cli, @actual-app/web.
What are the most common weakness types in actual-app CVEs?: actual-app's CVEs most often map to these CWE weakness types: CWE-1236 (Improper Neutralization of Formula Elements in a CSV File), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-284 (Improper Access Control), CWE-285 (Improper Authorization).
Are there public exploits for actual-app vulnerabilities?: Yes — 7 of actual-app's CVEs have a known public exploit.
How many critical actual-app vulnerabilities are there?: actual-app has 1 critical and 2 high-severity CVEs.
What is the average severity of actual-app CVEs?: The average CVSS base score across actual-app's scored CVEs is 6.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track actual-app vulnerabilities

Monitor new actual-app vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing