What’s Vulnerable › Products

enchant97 note-mark vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your enchant97 note-mark version is affected

Latest enchant97 note-mark vulnerabilities

• CVE-2026-50553 — Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) (CVSS 8.6)
• CVE-2026-50554 — Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark (CVSS 5.3)
• CVE-2026-44523 — Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery (CVSS 10.0)
• CVE-2026-44522 — Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution (CVSS 8.6)
• CVE-2026-41572 — Note Mark: Unauthenticated read of notes and assets in soft-deleted public books (CVSS 5.3)
• CVE-2026-41571 — Note Mark: OIDC-registered users authenticated by submitting password "null" (CVSS 9.4)
• CVE-2026-40265 — Note Mark has Broken Access Control on Asset Download (CVSS 5.9)
• CVE-2026-40263 — Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel (CVSS 3.7)
• CVE-2026-40262 — Note Mark has Stored XSS via Unrestricted Asset Upload (CVSS 8.7)
• CVE-2024-41819 — Note Mark has a stored XSS in the note link href attribute (CVSS 5.4)