github.com/enchant97/note-mark/backend vulnerabilities (Go)

9 vulnerabilities.

• github.com/enchant97/note-mark/backend Go Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVE-2026-50553 Fix available 8.6 HighJuly 9, 2026
• github.com/enchant97/note-mark/backend Go Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVE-2026-50554 Fix available 5.3 MediumJuly 9, 2026
• github.com/enchant97/note-mark/backend Go Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVE-2026-44523 Fix available 10.0 CriticalMay 7, 2026
• github.com/enchant97/note-mark/backend Go Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVE-2026-44522 Fix available 8.6 HighMay 7, 2026
• github.com/enchant97/note-mark/backend Go Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVE-2026-41572 Fix available 5.3 MediumApril 25, 2026
• github.com/enchant97/note-mark/backend Go Note Mark: OIDC-registered users authenticated by submitting password "null" CVE-2026-41571 Fix available 9.4 CriticalApril 25, 2026
• github.com/enchant97/note-mark/backend Go Note Mark has Broken Access Control on Asset Download CVE-2026-40265 Fix available 5.9 MediumApril 13, 2026
• github.com/enchant97/note-mark/backend Go Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel CVE-2026-40263 Fix available 3.7 LowApril 13, 2026
• github.com/enchant97/note-mark/backend Go Note Mark has Stored XSS via Unrestricted Asset Upload CVE-2026-40262 Fix available 8.7 HighApril 13, 2026