Actual
1 CVE in 1 Actual product, including Actual Sync Server. Newest: CVE-2026-3089 (2026-03-09). Severity, EPSS and public exploits for each.
Actual products with known CVEs
| Product | CVEs |
|---|---|
| Actual Sync Server | 1 |
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3089 | Medium | 6.5 | 2026-03-09 | Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user… |