Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-50553 | Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) | * | 8.6 | — | 2026-09-05 | |
| CVE-2026-50554 | Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-m... | * | 5.3 | — | 2026-09-04 | |
| CVE-2026-44522 | Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution | * | 8.6 | — | 2026-05-15 | |
| CVE-2026-44523 | Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery | * | 10.0 | — | 2026-05-15 | |
| CVE-2026-41572 | Note Mark: Unauthenticated read of notes and assets in soft-deleted public books | * | 5.3 | — | 2026-05-05 | |
| CVE-2026-41571 | Note Mark: OIDC-registered users authenticated by submitting password "null" | * | 9.4 | — | 2026-05-05 | |
| CVE-2026-40265 | Note Mark has Broken Access Control on Asset Download | * | 5.9 | — | 2026-04-17 | |
| CVE-2026-40263 | Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel | * | 3.7 | — | 2026-04-17 | |
| CVE-2026-40262 | Note Mark has Stored XSS via Unrestricted Asset Upload | * | 8.7 | — | 2026-04-17 | |
| CVE-2024-41819 | Note Mark has a stored XSS in the note link href attribute | * | 8.7 | — | 2024-07-30 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).