Enchant97 Note-mark vulnerabilities

• enchant97 note-mark Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVE-2026-50553 Fix available 8.6 HighJuly 9, 2026
• enchant97 note-mark Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVE-2026-50554 Fix available 5.3 MediumJuly 9, 2026
• enchant97 note-mark Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVE-2026-44523 Fix available 10.0 CriticalMay 7, 2026
• enchant97 note-mark Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVE-2026-44522 Fix available 8.6 HighMay 7, 2026
• enchant97 note-mark Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVE-2026-41572 Fix available 5.3 MediumApril 25, 2026
• enchant97 note-mark Note Mark: OIDC-registered users authenticated by submitting password "null" CVE-2026-41571 Fix available 9.4 CriticalApril 25, 2026
• enchant97 note-mark Note Mark has Broken Access Control on Asset Download CVE-2026-40265 Fix available 5.9 MediumApril 13, 2026
• enchant97 note-mark Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel CVE-2026-40263 Fix available 3.7 LowApril 13, 2026
• enchant97 note-mark Note Mark has Stored XSS via Unrestricted Asset Upload CVE-2026-40262 Fix available 8.7 HighApril 13, 2026
• enchantedcode note mark, enchant97 note-mark +1 more Note Mark has a stored XSS in the note link href attribute CVE-2024-41819 8.7 HighJuly 29, 2024