# github.com/enchant97/note-mark/backend (Go) vulnerabilities

9 known vulnerabilities (2 critical, 3 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/enchant97/note-mark/backend

## Advisories (9)

### [CVE-2026-50553](https://cve.now/CVE-2026-50553): Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

- Severity: High 8.6
- Published: Sep 4, 2026
- Affected: fixed in 0.0.0-20260601210719-67b7de04308a.

### [CVE-2026-50554](https://cve.now/CVE-2026-50554): Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

- Severity: Medium 5.3
- Published: Sep 3, 2026
- Affected: fixed in 0.0.0-20260601210758-9c9b72740f22.

### [CVE-2026-44522](https://cve.now/CVE-2026-44522): Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

- Severity: High 8.6
- Published: May 14, 2026
- Affected: fixed in 0.0.0-20260501152243-db3f72bff780.

### [CVE-2026-44523](https://cve.now/CVE-2026-44523): Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

- Severity: Critical 10.0
- Published: May 14, 2026
- Affected: fixed in 0.0.0-20260501152247-18b587758667.

### [CVE-2026-41572](https://cve.now/CVE-2026-41572): Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

- Severity: Medium 5.3
- Published: May 4, 2026
- Affected: fixed in 0.0.0-20260417132843-d1bf845a2a2d.

### [CVE-2026-41571](https://cve.now/CVE-2026-41571): Note Mark: OIDC-registered users authenticated by submitting password "null"

- Severity: Critical 9.4
- Published: May 4, 2026
- Affected: fixed in 0.0.0-20260417132909-dea5530cc989.

### [CVE-2026-40265](https://cve.now/CVE-2026-40265): Note Mark has Broken Access Control on Asset Download

- Severity: Medium 5.9
- Published: Apr 16, 2026
- Affected: fixed in 0.0.0-20260411145023-6593898855ad.

### [CVE-2026-40263](https://cve.now/CVE-2026-40263): Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

- Severity: Low 3.7
- Published: Apr 16, 2026
- Affected: fixed in 0.19.2-0.20260411145025-cf4c6f6acf70; all versions.

### [CVE-2026-40262](https://cve.now/CVE-2026-40262): Note Mark has Stored XSS via Unrestricted Asset Upload

- Severity: High 8.7
- Published: Apr 16, 2026
- Affected: fixed in 0.0.0-20260411145018-6bb62842ccb9.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/enchant97/note-mark/backend
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.