13949 matches found
EUVD-2026-74648
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory...
CVE-2026-21107
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory...
CVE-2026-21107: Out-of-bounds Write
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory...
PT-2026-88841
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory...
PT-2026-89161
Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...
CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
EUVD-2026-72354
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
CVE-2026-78325
CVE-2026-78325 is a cross-site scripting (XSS) vulnerability in the Evernote and Google Keep note importers of Standard Notes for Android through version 3.201.24 . An attacker can craft a malicious .enex or Google Keep HTML file that, when imported by a victim, executes arbitrary JavaScript in t...
CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
CVE-2026-78325 XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
CVE-2026-78325: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
PT-2026-86683
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and...
CVE-2026-85624 Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...
CVE-2026-70403
creationtimestamp| type| source ---|---|--- 2026-09-04 04:46:28+00:00| seen| https://jvn.jp/en/jp/JVN32505330 2026-09-04 07:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muoi44pycp2g 2026-09-04 08:08:07+00:00| seen|...
PT-2026-85548
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...
EUVD-2026-70529
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
CVE-2026-50554 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...
oscp-notes-2026 — Updated!
OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...
CVE-2026-50554: Exposure of Sensitive Information to an Unauthorized Actor
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but kee...