enchant97

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

enchant97 records in CISA KEV

No enchant97 vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2026-32452 CVE-2026-44523 · GHSA-q6mh-rqwh-g786

Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

HIGH 82

Note Mark is an open-source note-taking application.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00148 Published 2026-05-14 Fixed in 0.19.4, 0.0.0-20260501152247-18b587758667 CWE-326

TI-2026-30126 CVE-2026-41571 · GHSA-pxf8-6wqm-r6hh

Note Mark: OIDC-registered users authenticated by submitting password "null"

HIGH 82

Note Mark is an open-source note-taking application.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00367 Published 2026-05-04 Fixed in 0.0.0-20260417132909-dea5530cc989 CWE-287

TI-2026-29056 CVE-2026-40262 · GHSA-9pr4-rf97-79qh

Note Mark has Stored XSS via Unrestricted Asset Upload

HIGH 73

Note Mark is an open-source note-taking application.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00309 Published 2026-04-16 Fixed in 0.19.2, 0.0.0-20260411145018-6bb62842ccb9 CWE-434

TI-2026-37275 CVE-2026-50553 · GHSA-rqrh-8wpv-x7hh

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

HIGH 72

Note Mark is an open-source note-taking application.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00459 Published 2026-09-04 Fixed in 0.19.5, 0.0.0-20260601210719-67b7de04308a CWE-20

TI-2026-32451 CVE-2026-44522 · GHSA-g49p-4qxj-88v3

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

HIGH 72

Note Mark is an open-source note-taking application.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00565 Published 2026-05-14 Fixed in 0.19.4, 0.0.0-20260501152243-db3f72bff780 CWE-20

TI-2026-37276 CVE-2026-50554 · GHSA-588f-fvcv-xhvf

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

MEDIUM 63

Note Mark is an open-source note-taking application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00417 Published 2026-09-03 Fixed in 0.19.5, 0.0.0-20260601210758-9c9b72740f22 CWE-200

TI-2026-30127 CVE-2026-41572 · GHSA-3gr9-485j-v4xf

Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

MEDIUM 63

Note Mark is an open-source note-taking application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00243 Published 2026-05-04 Fixed in 0.19.3, 0.0.0-20260417132843-d1bf845a2a2d CWE-285

TI-2026-29059 CVE-2026-40265 · GHSA-p5w6-75f9-cc2p

Note Mark has Broken Access Control on Asset Download

MEDIUM 60

Note Mark is an open-source note-taking application.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00441 Published 2026-04-16 Fixed in 0.19.2, 0.0.0-20260411145023-6593898855ad CWE-862

TI-2026-29057 CVE-2026-40263 · GHSA-w6m9-39cv-2fwp

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

MEDIUM 51

Note Mark is an open-source note-taking application.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00258 Published 2026-04-16 Fixed in 0.19.2, 0.19.2-0.20260411145025-cf4c6f6acf70 CWE-208

Open these records in search →