triliumnotes has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 6. The median CVSS is 6.8 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-94 (4) and CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- trilium 6
Worst active — by depth score
CVE-2026-47727High· 8.8Trilium is an open-source hierarchical note-taking application49CVE-2026-53580High· 8.1Trilium is an open-source hierarchical note-taking application45CVE-2026-77438High· 7.5Trilium is an open-source hierarchical note-taking application41CVE-2026-53579Medium· 6.1Trilium is an open-source hierarchical note-taking application34CVE-2026-53578Medium· 6.1Trilium is an open-source hierarchical note-taking application34
triliumnotes vulnerabilities
CVEs affecting triliumnotes, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-77438High· 7.5Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauth…
CVE-2026-53580High· 8.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, all…
CVE-2026-53579Medium· 6.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored with…
CVE-2026-53578Medium· 6.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is sto…
CVE-2026-48996Medium· 6.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into …
CVE-2026-47727High· 8.8Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing a…