A
ActualBudget
Security Risk Profile
48
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 4 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 24, 2026 to present
4
Total CVEs
3
Critical+High
0
Exploited
0
Unpatched
Threat Assessment
Avg CVSS
7.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
0
Critical/High
Risk Level
48/100
medium
Severity Distribution
Critical
1High
2Medium
1Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
3Age Distribution
Common Weaknesses (CWE)
1
Path Traversal
1
Most Affected Products
1. npm/@actual-app/sync-server4
2. ActualBudget Actual Node.js4
3. Actual Sync Server1
4. ActualBudget Actual1
5. Actual ActualBudget Server1
Recent Vulnerabilities
See more →CVE-2026-33318
CVSS 8.8high
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
Apr 23, 2026
CVE-2026-3089
CVSS 5.3EPSS 0%medium
Actual Sync Server 26.2.1 - Authenticated Path Traversal
Mar 9, 2026
CVE-2026-27638
CVSS 7.1EPSS 0%high
ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
Feb 26, 2026
CVE-2026-27584
CVSS 9.2EPSS 0%critical
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
Feb 24, 2026
Monitor ActualBudget in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.