6783 matches found
CVE-2026-47727
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
EUVD-2026-67237
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", without...
CVE-2026-53578: Improper Neutralization of Input During Web Page Generation
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...
CVE-2026-53579: Improper Neutralization of Input During Web Page Generation
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...
PT-2026-82682
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...
PT-2026-82681
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...
CVE-2026-48996: Improper Neutralization of Input During Web Page Generation
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...
RUSTSEC-2026-0284 Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`
Two independent soundness problems, both reachable from safe Rust. Map::intoiter drops builder the caller-supplied hasher H and incin by hand, then commits the ownership transfer with mem::forgetself. H::drop is user code and may panic. If it does, mem::forgetself is skipped and the still-live Ma...
Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`
Two independent soundness problems, both reachable from safe Rust. Map::intoiter drops builder the caller-supplied hasher H and incin by hand, then commits the ownership transfer with mem::forgetself. H::drop is user code and may panic. If it does, mem::forgetself is skipped and the still-live Ma...
Malicious code in ultra-safe-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15804 Malicious code in ultra-safe-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15790 Malicious code in tiny-safe-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-safe-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in nano-safe-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15758 Malicious code in nano-safe-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in mini-safe-mod (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15747 Malicious code in mini-safe-mod (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15746 Malicious code in mini-safe-lib (RubyGems)
--- -= Per source details. Do not edit below this line.=-...