CVE-2026-39991 — Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting (XSS) vulnerability affects Notes Station 3. If a remote attacker gains a user account, they can exploit the vulnerability to inject malicious code.