T
Vendor security profile
TriliumNext
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical3
CISA KEV0
Public exploit6
Patch rate%0
Avg. CVSS8.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
7
0
0
CVE KEV
CVE severity distribution
7toplam CVE
Critical3 (43%)
High4 (57%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%86
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
7.5
CVE-2026-77438
Trilium unauthenticated share-search discloses password-protected and hidden shared notes
T
Patch status unknownEPSS %0
8.1
CVE-2026-53580
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
T
Patch status unknownEPSS %0
9.3
CVE-2026-53579
Trilium: Note Import to RCE via Book Note
T
Patch status unknownEPSS %0
9.3
CVE-2026-53578
Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
T
Patch status unknownEPSS %0
9.3
CVE-2026-48996
Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
T
Patch status unknownEPSS %0
8.6
CVE-2026-47727
Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
T
Patch status unknownEPSS %1
8.3
CVE-2026-45733
Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
T
Patch status unknownEPSS %0