CVE-2022-2290

CVE-2022-2290 is a reflected Cross-Site Scripting (XSS) vulnerability in Trilium Notes prior to 0.52.4 and 0.53.1-beta, as disclosed by multiple sources. The issue affects the web interface where user-supplied input can be reflected in the browser without proper sanitization, enabling an attacker...

CVE-2025-68621

Trilium Notes has a timing-attack vulnerability in the sync authentication endpoint (/api/login/sync) affecting versions before 0.101.0. Unauthenticated remote attackers can recover HMAC hashes byte-by-byte via statistical timing analysis, enabling complete authentication bypass and full read/wri...