TriliumNext Trilium

• CVE-2026-77438 High 7.5 Trilium unauthenticated share-search discloses password-protected and hidden shared notes 0.4%
• CVE-2026-53580 High 8.1 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature 0.5%
• CVE-2026-53579 Critical 9.3 Trilium: Note Import to RCE via Book Note 0.3%
• CVE-2026-53578 Critical 9.3 Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml 0.3%
• CVE-2026-48996 Critical 9.3 Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client 0.3%
• CVE-2026-47727 High 8.6 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668) 0.5%
• CVE-2026-45733 High 8.3 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app 0.4%
• CVE-2026-45668 Critical 9.3 Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled) 0.2%
• CVE-2026-39311 Medium 6.8 Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments 0.3%
• CVE-2026-39310 High 8.6 Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds 0.4%
• CVE-2026-39309 Medium 5.5 Trilium Notes: macOS TCC Bypass via Prompt Spoofing 0.2%
• CVE-2026-35593 Medium 6.8 Trilium Notes has Local File Inclusion via upload modified file API endpoint 0.6%
• CVE-2025-68621 High 7.4 Trilium Notes has a Timing Attack Vulnerability in /api/login/sync 0.6%
• CVE-2025-53544 High 7.5 Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval 0.4%