TI-2026-36250 CVE-2026-48996
Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
Priority HIGH 75
Trilium is an open-source hierarchical note-taking application.
TriliumNext
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
TriliumNext records in CISA KEVNo TriliumNext vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records in Trilium · all components
Priority HIGH 73
Trilium is an open-source hierarchical note-taking application.
TI-2026-54012 CVE-2026-77438
Trilium unauthenticated share-search discloses password-protected and hidden shared notes
Priority HIGH 72
Trilium is an open-source hierarchical note-taking application.
TI-2026-35228 CVE-2026-47727
Code injection in TriliumNext Trilium
Priority HIGH 72
Trilium is an open-source hierarchical note-taking application.
TI-2026-38641 CVE-2026-53580
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
Priority HIGH 68
Trilium is an open-source hierarchical note-taking application.
TI-2026-38640 CVE-2026-53579
Trilium: Note Import to RCE via Book Note
Priority MEDIUM 42
Trilium is an open-source hierarchical note-taking application.
Priority LOW 35
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.
TI-2022-02113 CVE-2022-2290 · GHSA-4fjp-3mcp-2938
Cross-site Scripting (XSS) - Reflected in zadam/trilium
Priority LOW 33
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.