Skip to content
Triliumnext vulnerabilities
Newest
-
triliumnext trilium
Trilium unauthenticated share-search discloses password-protected and hidden shared notes
CVE-2026-77438
7.5 High
-
triliumnext trilium
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
CVE-2026-53580
8.1 High
-
triliumnext trilium
Trilium: Note Import to RCE via Book Note
CVE-2026-53579
9.3 Critical
-
triliumnext trilium
Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
CVE-2026-53578
9.3 Critical
-
triliumnext trilium
Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
CVE-2026-48996
9.3 Critical
-
triliumnext trilium
Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
CVE-2026-47727
8.6 High
-
triliumnext trilium
Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
CVE-2026-45733
8.3 High
-
triliumnext trilium
Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)
CVE-2026-45668
9.3 Critical
-
triliumnext trilium
Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments
CVE-2026-39311
6.8 Medium
-
triliumnext trilium
Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds
CVE-2026-39310
8.6 High
-
triliumnext trilium
Trilium Notes: macOS TCC Bypass via Prompt Spoofing
CVE-2026-39309
5.5 Medium
-
triliumnext trilium
Trilium Notes has Local File Inclusion via upload modified file API endpoint
CVE-2026-35593
6.8 Medium
-
triliumnext trilium
Trilium Notes has a Timing Attack Vulnerability in /api/login/sync
CVE-2025-68621
Public exploit
7.4 High
-
triliumnext trilium
Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval
CVE-2025-53544
7.5 High