Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/enchant97/note-mark/backend

9 known vulnerabilities (2 critical, 3 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 critical, 3 high, 3 medium, 1 low
Registry
pkg.go.dev

Advisories 9

  • Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

    Affected: fixed in 0.0.0-20260601210719-67b7de04308a.

  • CVE-2026-50554Medium 5.3

    Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

    Affected: fixed in 0.0.0-20260601210758-9c9b72740f22.

  • Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

    Affected: fixed in 0.0.0-20260501152243-db3f72bff780.

  • CVE-2026-44523Critical 10.0

    Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

    Affected: fixed in 0.0.0-20260501152247-18b587758667.

  • CVE-2026-41572Medium 5.3

    Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

    Affected: fixed in 0.0.0-20260417132843-d1bf845a2a2d.

  • CVE-2026-41571Critical 9.4

    Note Mark: OIDC-registered users authenticated by submitting password "null"

    Affected: fixed in 0.0.0-20260417132909-dea5530cc989.

  • CVE-2026-40265Medium 5.9

    Note Mark has Broken Access Control on Asset Download

    Affected: fixed in 0.0.0-20260411145023-6593898855ad.

  • Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

    Affected: fixed in 0.19.2-0.20260411145025-cf4c6f6acf70; all versions.

  • Note Mark has Stored XSS via Unrestricted Asset Upload

    Affected: fixed in 0.0.0-20260411145018-6bb62842ccb9.