CVE-2026-85624

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...

CVE-2026-85624

Blinko 1.8.7 is vulnerable to a cross-user private note disclosure in the noteReferenceList procedure, which performs no ownership verification on supplied note identifiers. An authenticated attacker can enumerate sequential note IDs to retrieve the complete content of other users' private notes ...

CVE-2026-20682

A logic issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, iOS 18.7.5 and iPadOS 18.7.5. An attacker may be able to discover a user’s deleted notes...

CVE-2025-31256

The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes...

PT-2024-25691

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.26.2 Description The issue affects MantisBT, an open source issue tracker, where an issue referencing a note from another issue that the user does not have access to becomes hyperlinked. Although clicking the link...

GitLab: Private System Note Disclosure using GraphQL

Summary When you use the REST API or UI to view an issue's discussion/notes, private system note is hidden to member's only. Such as moving an issue to a private project, making issue as duplicate of a confidential issue, someone mentioned this issue in a confidential issue. They are properly...