CVE-2026-44283

etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user...

Missing Authentication for Critical Function

Overview @actual-app/sync-server is an actual syncing server Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SimpleFIN and PluggyAI integration endpoints. An attacker can access sensitive bank account balances and transaction information by...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function on the critical API endpoints messages, transactions, and session, handling sensitive user data and system operations. An unauthenticated attacker can access confidential conversation data an...