PT-2026-89893

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync server daemon on TCP port 13136. The daemon, which ru...

CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...

Missing Authorization

Overview @actual-app/sync-server is an actual syncing server Affected versions of this package are vulnerable to Missing Authorization via the requireFileAccess check in the sync-server handlers for /delete-user-file, /reset-user-file, and /user-create-key. An attacker can delete, reset, or rekey...

@actual-app/sync-server (>=25.4.0-alpha.0, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=25.3.1, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =25.3.1, =25.4.0-alpha.0, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: MEND:CVE-2026-50179...

anki-sync-server (2.4.0) potentially affected by CVE-2024-26020 via anki (2.1.49)

anki PYPI version 2.1.49 is affected by a known vulnerability. The following packages have a transitive dependency on anki and may be impacted: - anki-sync-server 2.4.0 Source cves: CVE-2024-26020 Source advisory: OSV:PYSEC-2026-1116...

anki-sync-server (2.4.0) potentially affected by CVE-2024-32152 via anki (2.1.49)

anki PYPI version 2.1.49 is affected by a known vulnerability. The following packages have a transitive dependency on anki and may be impacted: - anki-sync-server 2.4.0 Source cves: CVE-2024-32152 Source advisory: OSV:PYSEC-2026-1117...

anki-sync-server (2.4.0) potentially affected by CVE-2024-29073 via anki (2.1.49)

anki PYPI version 2.1.49 is affected by a known vulnerability. The following packages have a transitive dependency on anki and may be impacted: - anki-sync-server 2.4.0 Source cves: CVE-2024-29073 Source advisory: OSV:PYSEC-2026-1118...

CVE-2026-46700: Improper Authorization

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: OSV:GHSA-XQJM-27PC-RVWM...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: GHSA-XQJM-27PC-RVWM...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPWEB-17818134...

CVE-2026-42604: Incorrect Authorization

Actual is a local-first personal finance tool. The POST /openid/config endpoint in Actual Budget's sync-server versions = 26.4.0 exposes the full OpenID Connect configuration—including the OAuth2 clientsecret—to any caller who knows the bootstrap password. The endpoint also lacks authentication a...

Command Injection

Overview @context-sync/server is an Universal Context layer McP server Affected versions of this package are vulnerable to Command Injection via the git-integration component. An attacker can execute arbitrary operating system commands by sending specially crafted input to the affected component...

VulnCheck KEV: CVE-2025-2749

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations...

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations...

CVE-2026-3089

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments ../ can escape the intended directory and write files outside...

EUVD-2026-10341

Actual Sync Server has an Authenticated Path Traversal...

GHSA-27VG-33GH-4HWG Actual Sync Server has an Authenticated Path Traversal

Description Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments ../ can escape the intended directory and write files outsid...

EUVD-2026-10340

Actual Sync Server has an Authenticated Path Traversal...

Actual Sync Server has an Authenticated Path Traversal

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments ../ can escape the intended directory and write files outside userFiles...