actual vulnerabilities
CVEs whose affected-version data names the actual package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-57449High· 7.1PoCActual is a local-first personal finance tool
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TO…
▾ Midnightactualbudget · actualEPSS 0.26%via NVD
CVE-2026-42890Mediumactual Allows Electron to Run As Node
actual Allows Electron to Run As Node
▾ Sunlitactual · actualEPSS 0.13%via GHSA