actual-app has 4 CVEs on record. The busiest recent month was June 2026 with 4. The median CVSS is 4.4 (medium). Most affected products: @actual-app/sync-server (2), @actual-app/cli (1), @actual-app/web (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.4
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
Weakness classes
Products
- @actual-app/sync-server 2
- @actual-app/cli 1
- @actual-app/web 1
Worst active — by depth score
CVE-2026-49229High· 8.3@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens46CVE-2026-46672Medium· 4.6@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper25CVE-2026-46700Medium· 4.3@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets24CVE-2026-50179Medium· 4.2@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields23
actual-app vulnerabilities
CVEs affecting actual-app, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-46672Medium· 4.6@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
CVE-2026-46700Medium· 4.3@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
CVE-2026-49229High· 8.3@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
CVE-2026-50179Medium· 4.2@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields