Browse all 3 CVE security advisories affecting actualbudget. AI-powered Chinese analysis, POCs, and references for each vulnerability.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-33318 | Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers — actualCWE-284 | 8.8 | High | 2026-04-24 |
| CVE-2026-27638 | ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode — actualCWE-862 | 8.1AI | HighAI | 2026-02-26 |
| CVE-2026-27584 | ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints — actualCWE-306 | 7.5 | - | 2026-02-24 |
This page lists every published CVE security advisory associated with actualbudget. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.