{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/enchant97/note-mark/backend","cve_ids":["CVE-2026-40263"],"ecosystem":"Go","epss":0.00258,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-w6m9-39cv-2fwp","id":"tcs_01M5KGP7G6PCBN18E2RX6ZSK77","modified_at":"2026-06-25T23:01:28.026622980Z","published_at":"2026-06-25T22:34:38Z","references":["https://osv.dev/vulnerability/GO-2026-5696","https://github.com/enchant97/note-mark/security/advisories/GHSA-w6m9-39cv-2fwp","https://nvd.nist.gov/vuln/detail/CVE-2026-40263","https://github.com/enchant97/note-mark/commit/cf4c6f6acf70b569d80396d323b067c00d45c034"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GO-2026-5696","url":"https://osv.dev/vulnerability/GO-2026-5696"},{"source":"nvd","source_id":"CVE-2026-40263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40263"}],"summary":"Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel in github.com/enchant97/note-mark/backend"}