Security feed

25 October 2026

advisoryOfficial CVE List25 Oct 2026

Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.

Akaunting CVE-2026-19198

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-19198

Akaunting

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-19198
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #28587 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:45:04 GMT
Publisher date: Wed, 19 Aug 2026 18:58:01 GMT

Read the original announcement

24 October 2026

advisoryOfficial CVE List24 Oct 2026

Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

akaunting CVE-2022-51019