MEDIUM5.3Go
GHSA-3gr9-485j-v4xf· CVE-2026-41572, GO-2026-5085Note Mark: Unauthenticated read of notes and assets in soft-deleted public books
Modified: 6/25/2026
package
Go/github.com/enchant97/note-mark/backend
pkg:go/github.com/enchant97/note-mark/backend
MEDIUM5.3Go
GHSA-588f-fvcv-xhvf· CVE-2026-50554, GO-2026-5948Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books
Modified: 7/21/2026
HIGH8.7Go
GHSA-9pr4-rf97-79qh· CVE-2026-40262, GO-2026-5295Note Mark has Stored XSS via Unrestricted Asset Upload
Modified: 6/25/2026
HIGHGo
GHSA-g49p-4qxj-88v3· CVE-2026-44522, GO-2026-5389Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution
Modified: 6/25/2026
MEDIUM5.9Go
GHSA-p5w6-75f9-cc2p· CVE-2026-40265, GO-2026-5530Note Mark has Broken Access Control on Asset Download
Modified: 6/25/2026
CRITICAL9.4Go
GHSA-pxf8-6wqm-r6hh· CVE-2026-41571, GO-2026-5557Note Mark: OIDC-registered users authenticated by submitting password "null"
Modified: 6/25/2026
CRITICAL10.0Go
GHSA-q6mh-rqwh-g786· CVE-2026-44523, GO-2026-5567Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery
Modified: 6/25/2026
HIGHGo
GHSA-rqrh-8wpv-x7hh· CVE-2026-50553, GO-2026-5949Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Modified: 7/21/2026
LOW3.7Go
GHSA-w6m9-39cv-2fwp· CVE-2026-40263, GO-2026-5696Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
Modified: 6/25/2026
—Go
GO-2026-5696· CVE-2026-40263, GHSA-w6m9-39cv-2fwpNote Mark: Username Enumeration via Login Endpoint Timing Side-Channel in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5085· CVE-2026-41572, GHSA-3gr9-485j-v4xfNote Mark: Unauthenticated read of notes and assets in soft-deleted public books in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5295· CVE-2026-40262, GHSA-9pr4-rf97-79qhNote Mark has Stored XSS via Unrestricted Asset Upload in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5389· CVE-2026-44522, GHSA-g49p-4qxj-88v3Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5530· CVE-2026-40265, GHSA-p5w6-75f9-cc2pNote Mark has Broken Access Control on Asset Download in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5557· CVE-2026-41571, GHSA-pxf8-6wqm-r6hhNote Mark: OIDC-registered users authenticated by submitting password "null" in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5567· CVE-2026-44523, GHSA-q6mh-rqwh-g786Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery in github.com/enchant97/note-mark/backend
Modified: 6/25/2026
—Go
GO-2026-5948· CVE-2026-50554, GHSA-588f-fvcv-xhvfNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend
Modified: 7/21/2026
—Go
GO-2026-5949· CVE-2026-50553, GHSA-rqrh-8wpv-x7hhNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) in github.com/enchant97/note-mark/backend
Modified: 7/21/2026