Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

GHSA-M62C-5Q34-F3CF Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

CVE-2026-57449

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When "ACTUALGITHUBTOKEN" is configured, the proxy automatically attaches the...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449

The Actual Sync Server (prior to version 26.7.0 ) is vulnerable to a CORS proxy allowlist bypass. When ACTUAL_GITHUB_TOKEN is configured, the server's CORS proxy uses a raw startsWith() prefix test to validate GitHub repositories against an official plugin allowlist. Because the check fails to re...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

PT-2026-99134

Name of the Vulnerable Software and Affected Versions Actual Sync Server versions prior to 26.7.0 Description The CORS proxy in Actual Sync Server allows authenticated users to fetch resources from repositories on an official plugin allowlist. When the ACTUAL GITHUB TOKEN is configured, the proxy...

CVE-2026-57449: Exposure of Sensitive Information to an Unauthorized Actor

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

PT-2026-94984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the kone keep values up to date and kone profile activated functions use an 8-bit profile value supplied by a device as an index for the 5-element kone-profiles arr...

PT-2026-95010

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains a flaw where the do actual install function in libmport/bundle read install pkg.c utilizes path-based lstat, chown, stat, and chmod operations during package...

CVE-2026-83432: Improper Access Control

Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite component: Estimate and Actual Charges. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Depot...

@fancyliu/speclite (>=0.1.0, <=0.4.1), actual-moneymoney (>=3.0.0, <=3.6.0) +1 more potentially affected by CVE-2026-77465 via toml (>=4.1.1, <=4.1.2)

toml NPM version =4.1.1, =0.1.0, =3.0.0, =2.7.0, =2.12.4 Source cves: CVE-2026-77465 Source advisory: OSV:GHSA-82X6-Q7MM-W9CF...

@fancyliu/speclite (>=0.1.0, <=0.4.1), actual-moneymoney (>=3.0.0, <=3.6.0) +1 more potentially affected by CVE-2026-63376 via toml (4.1.1)

toml NPM version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @fancyliu/speclite =0.1.0, =3.0.0, =2.7.0, =2.11.3 Source cves: CVE-2026-63376 Source advisory: OSV:GHSA-V5MP-JGW5-2X6J...

Malicious Package

Overview hubert-document-actual-insurance-rules-am is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

PT-2026-64560

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the usbio bulk msg function. The function copies bpkt len bytes from the bulk IN buffer usbio-rxbuf into the caller's buffer. However, bpkt len is...

SUSE CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

CVE-2026-63904 usb: usbtmc: check URB actual_length for interrupt-IN notifications

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the...