enchant97/note-mark Security Advisories | GitStock

high2026-07-09

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

GHSA-rqrh-8wpv-x7hh · CVE-2026-50553

medium2026-07-09

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books

GHSA-588f-fvcv-xhvf · CVE-2026-50554

critical2026-05-07

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

GHSA-q6mh-rqwh-g786 · CVE-2026-44523

high2026-05-07

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

GHSA-g49p-4qxj-88v3 · CVE-2026-44522

medium2026-04-25

Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

GHSA-3gr9-485j-v4xf · CVE-2026-41572

critical2026-04-25

Note Mark: OIDC-registered users authenticated by submitting password "null"

GHSA-pxf8-6wqm-r6hh · CVE-2026-41571

medium2026-04-13

Note Mark has Broken Access Control on Asset Download

GHSA-p5w6-75f9-cc2p · CVE-2026-40265

low2026-04-13

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

GHSA-w6m9-39cv-2fwp · CVE-2026-40263

high2026-04-13

Note Mark has Stored XSS via Unrestricted Asset Upload

GHSA-9pr4-rf97-79qh · CVE-2026-40262