6468 matches found
CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
CVE-2026-47727
Trilium (open-source hierarchical note-taking app) versions prior to 0.104.0 are vulnerable to remote code execution via a bypass of its default-on "Safe import" filter. The shareTemplate relation is omitted from the built-in list of dangerous attributes, so it is not disabled on import. An attac...
EUVD-2026-67237
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", without...
CVE-2026-53579: Improper Neutralization of Input During Web Page Generation
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...
CVE-2026-48996: Improper Neutralization of Input During Web Page Generation
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...
CVE-2026-53578: Improper Neutralization of Input During Web Page Generation
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...
PT-2026-82681
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...
PT-2026-82682
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...
Malicious code in mega-safe-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15721 Malicious code in mega-safe-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in mega-safe-hub (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15720 Malicious code in mega-safe-hub (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in hyper-safe-kit (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15708 Malicious code in hyper-safe-kit (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in hyper-safe-hub (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15707 Malicious code in hyper-safe-hub (RubyGems)
--- -= Per source details. Do not edit below this line.=-...