enchant97 note-mark vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20269

Newest CVEs

• CVE-2026-50553

  Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

  enchant97 · note-mark

  High8.6
• CVE-2026-50554

  Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

  enchant97 · note-mark

  Medium5.3
• CVE-2026-44522

  Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

  enchant97 · note-mark

  High8.6
• CVE-2026-44523

  Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

  enchant97 · note-mark

  Critical10.0
• CVE-2026-41572

  Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

  enchant97 · note-mark

  Medium5.3
• CVE-2026-41571

  Note Mark: OIDC-registered users authenticated by submitting password "null"

  enchant97 · note-mark

  Critical9.4
• CVE-2026-40265

  Note Mark has Broken Access Control on Asset Download

  enchant97 · note-mark

  Medium5.9
• CVE-2026-40263

  Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

  enchant97 · note-mark

  Low3.7
• CVE-2026-40262

  Note Mark has Stored XSS via Unrestricted Asset Upload

  enchant97 · note-mark

  High8.7
• CVE-2024-41819

  Note Mark has a stored XSS in the note link href attribute

  enchant97 · note-mark

  High8.7