streetwriters notesnook

• CVE-2026-42090 Critical 9.6 Notesnook: RCE via stored XSS in note export rendering 0.5%
• CVE-2026-33978 Medium 5.4 Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata 0.3%
• CVE-2026-31876 Medium 5.4 Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`) 0.2%