Vulnerabilidades em TriliumNext
14 resultadosAnálise Vexday
TriliumNext apresenta portfólio reduzido de 7 vulnerabilidades com apenas 1 classificada como crítica, mas com elevada atividade recente: 5 CVEs publicadas nos últimos 90 dias, sugerindo vulnerabilidades ativas em versões atuais. A ausência de exploração observada em ambiente wild (0 KEV) é positiva, porém a fraqueza dominante em traversal de diretórios (CWE-22) aponta para falhas de validação de entrada que costumam atrair interesse de atacantes.
CVE-2026-47727HIGHTrilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)EPSS 0.7%CVE-2026-35593MEDIUMTrilium Notes has Local File Inclusion via upload modified file API endpointEPSS 0.7%CVE-2025-68621HIGHTrilium Notes has a Timing Attack Vulnerability in /api/login/syncEPSS 0.5%CVE-2026-39310HIGHTrilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) BuildsEPSS 0.5%CVE-2026-53580HIGHTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureEPSS 0.5%CVE-2026-45733HIGHTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appEPSS 0.4%CVE-2026-77438HIGHTrilium unauthenticated share-search discloses password-protected and hidden shared notesEPSS 0.4%CVE-2026-39311MEDIUMTrilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG AttachmentsEPSS 0.4%CVE-2025-53544HIGHTrilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed RetrievalEPSS 0.4%CVE-2026-53578CRITICALTrilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtmlEPSS 0.3%CVE-2026-53579CRITICALTrilium: Note Import to RCE via Book NoteEPSS 0.3%CVE-2026-48996CRITICALTrilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop clientEPSS 0.3%CVE-2026-45668CRITICALTrilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)EPSS 0.2%CVE-2026-39309MEDIUMTrilium Notes: macOS TCC Bypass via Prompt SpoofingEPSS 0.2%