EUVD-2026-70529

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...

SUSE CVE-2026-41572

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/id, /api/notes/id/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note I...

org.craftercms:crafter-social (2.3.6), org.grails:gorm-mongodb-spring-boot (>=1.0.0.rc2, <=1.0.0.ga) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.craftercms:crafter-social 2.3.6 -...

com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...

org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...

in.clouthink.daas:daas-token (>=1.0.0, <=1.8.1), io.github.jhipster.loaded:agent (>=0.5, <=0.12) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.1.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - in.clouthink.daas:daas-token =1.0.0, =0.5, =0.5, =0.5, =0.5,...

org.grails:gorm-mongodb-spring-boot (1.0.0.m1), org.grails:grails-datastore-gorm-mongodb (>=2.0.0.release, <=2.0.1.release) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.0.0.m1 -...

org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...

org.grails:gorm-mongodb-spring-boot (1.0.0.m1), org.grails:grails-datastore-gorm-mongodb (>=2.0.0.release, <=2.0.1.release) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.0.0.m1 -...

org.grails:gorm-mongodb-spring-boot (1.1.0.release), org.springframework.boot:spring-boot-starter-data-mongodb (>=1.1.0.release, <=1.1.3.release) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.5.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.1.0.release -...

io.micronaut.groovy:micronaut-function-groovy (2.0.0.rc1), io.micronaut.groovy:micronaut-gorm-common (2.0.0.rc1) +35 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.0.0.rc1)

io.micronaut:micronaut-inject MAVEN version 2.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.groovy:micronaut-function-groovy 2.0.0.rc1 - io.micronaut.groovy:micronaut-gorm-comm...

io.micronaut.configuration:micronaut-aws-common (1.0.2), io.micronaut.configuration:micronaut-cassandra (1.0.2) +59 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (1.0.2)

io.micronaut:micronaut-inject MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.configuration:micronaut-aws-common 1.0.2 - io.micronaut.configuration:micronaut-cassandr...

CVE-2026-41572

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/id, /api/notes/id/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note I...

CVE-2026-41572 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/id, /api/notes/id/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note I...

CVE-2026-41572: Improper Authorization

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/id, /api/notes/id/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note I...

PT-2026-36891

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.3 Description An issue exists where notes and uploaded assets remain accessible after a public book is soft-deleted. Unauthenticated users with the note ID or slug path can access data via the endpoints...

CVE-2019-15562

GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm...

io.micronaut.configuration:micronaut-multitenancy-gorm (1.0.0.rc3), io.micronaut.configuration:micronaut-security-ldap (1.0.0.rc3) +7 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.0.rc3)

io.micronaut:micronaut-http-server MAVEN version 1.0.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-multitenancy-gorm 1.0.0.rc3 -...