From 19553c6f73ada76c1cf18342af27b871570d1c41 Mon Sep 17 00:00:00 2001
From: cookesan <6601329+cookesan@users.noreply.github.com>
Date: Tue, 30 Jun 2026 04:44:26 -0400
Subject: [PATCH 1/2] Add Actual Sync Server fixed package reference

---
 .../2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json b/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json
index a23196201b248..4d3d9ab74d16a 100644
--- a/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json
+++ b/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json
@@ -46,6 +46,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/actualbudget/actual"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://www.npmjs.com/package/@actual-app/sync-server/v/26.6.0"
     }
   ],
   "database_specific": {
@@ -57,4 +61,4 @@
     "github_reviewed_at": "2026-06-22T23:19:56Z",
     "nvd_published_at": null
   }
-}
\ No newline at end of file
+}

From d89e2ff45022191224dcb3c7fcb1272c054f220d Mon Sep 17 00:00:00 2001
From: cookesan <6601329+cookesan@users.noreply.github.com>
Date: Tue, 30 Jun 2026 15:41:14 -0400
Subject: [PATCH 2/2] Add Actual Sync fixed source tag reference

---
 .../2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json b/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json
index 4d3d9ab74d16a..8e238bdd99fec 100644
--- a/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json
+++ b/advisories/github-reviewed/2026/06/GHSA-cq9c-6w48-qmfg/GHSA-cq9c-6w48-qmfg.json
@@ -47,6 +47,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/actualbudget/actual"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/actualbudget/actual/tree/v26.6.0"
+    },
     {
       "type": "PACKAGE",
       "url": "https://www.npmjs.com/package/@actual-app/sync-server/v/26.6.0"