github.com/enchant97/note-mark/backend (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/enchant97/note-mark/backend, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (7)

• CVE-2026-44523 — CVSS 10.0 (critical): Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET…
• CVE-2026-41571 — CVSS 9.4 (critical): Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded…
• CVE-2026-40262 — CVSS 8.7 (high): Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline…
• CVE-2026-44522: Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to…
• CVE-2026-40265 — CVSS 5.9 (medium): Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset download endpoint at /api/notes/{noteID}/assets…
• CVE-2026-41572 — CVSS 5.3 (medium): Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes…
• CVE-2026-40263 — CVSS 3.7 (low): Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoint performs bcrypt password verification…