enchant97 note-mark

• CVE-2026-50553 High 8.6 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) 0.5%
• CVE-2026-50554 Medium 5.3 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark 0.4%
• CVE-2026-44522 High 8.6 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution 0.6%
• CVE-2026-44523 Critical 10.0 Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery 0.1%
• CVE-2026-41572 Medium 5.3 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books 0.2%
• CVE-2026-41571 Critical 9.4 Note Mark: OIDC-registered users authenticated by submitting password "null" 0.4%
• CVE-2026-40265 Medium 5.9 Note Mark has Broken Access Control on Asset Download 0.4%
• CVE-2026-40263 Low 3.7 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel 0.3%
• CVE-2026-40262 High 8.7 Note Mark has Stored XSS via Unrestricted Asset Upload 0.3%
• CVE-2024-41819 High 8.7 Note Mark has a stored XSS in the note link href attribute 0.8%