CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-53579 Trilium: Note Import to RCE via Book Note

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-81753

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753 Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81753

Flowintel versions >= 3.3.0 are affected by a stored XSS vulnerability in case notes that contain Mermaid diagram blocks . Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note can store a crafted Mermaid payload that...

EUVD-2026-67009

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81491

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

EUVD-2026-66835

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingestnotes/teleportnotes/syncnotes/projectfolder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publishe...

PT-2026-82501

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Stored Cross-Site Scripting XSS occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edi...

PT-2026-82682

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

PT-2026-82382

Name of the Vulnerable Software and Affected Versions boxpositron with-context-mcp versions prior to 3.0.8 Description A flaw in the ingest notes/teleport notes/sync notes/project folder function within the src/index.ts file allows for remote path traversal. Path traversal is a condition where an...

CVE-2026-73335

creationtimestamp| type| source ---|---|--- 2026-08-26 05:20:04+00:00| seen| https://jvn.jp/en/jp/JVN67155805 2026-09-25 00:26:38+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mwcj4j6mfc2t...

CVE-2026-76148

creationtimestamp| type| source ---|---|--- 2026-08-26 05:15:02+00:00| seen| https://jvn.jp/en/jp/JVN18496672...

CVE-2026-76149

creationtimestamp| type| source ---|---|--- 2026-08-26 04:45:04+00:00| seen| https://jvn.jp/en/jp/JVN18496672...

Release Information for NetApp ONTAP Plug-In for Veeam Backup & Replication

This plug-in leverages the Veeam Universal Storage API, which enables storage OEMs to allow Veeam Backup & Replication integration to the arrays for backup and replication jobs. Requirements Before installing NetApp ONTAP Plug-In v2.0.14, ensure that you are running at least Veeam Backup &...

CVE-2026-78372

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...