Vendor

    TriliumNext

    8 known vulnerabilities in products by TriliumNext, 0 of them actively exploited (CISA KEV).

    Key figures

    8

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in TriliumNext
    MediumCVE-2022-2290

    Cross-site Scripting (XSS) - Reflected in zadam/trilium

    also in 1 other product

    		6.4
    HighCVE-2026-47727

    Trilium: Code Injection

    also in 1 other product

    		8.8
    HighCVE-2026-53580

    Trilium: External Control of File Name or Path

    also in 1 other product

    		8.1
    CriticalCVE-2026-53579

    Trilium: Note Import to RCE via Book Note

    also in 1 other product

    		6.1
    CriticalCVE-2026-53578

    Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml

    also in 1 other product

    		6.1
    CriticalCVE-2026-48996

    Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

    also in 1 other product

    		6.1
    HighCVE-2026-77438

    Trilium unauthenticated share-search discloses password-protected and hidden shared notes

    also in 1 other product

    		7.5
    HighCVE-2025-68621

    Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

    also in 1 other product

    		7.4

    Products

    Products by TriliumNext
    Trilium80