CVE-2026-71272 | High | 8.5 | 2026-08-05 | Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates th… |
CVE-2026-71271 | High | 8.5 | 2026-08-05 | Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never c… |
CVE-2026-6634 | Medium | 6.3 | 2026-04-20 | A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInst… |
CVE-2025-65799 | Medium | 4.3 | 2025-12-08 | A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal. |
CVE-2025-65797 | Medium | 6.5 | 2025-12-08 | Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete… |
CVE-2025-65795 | High | 7.5 | 2025-12-08 | Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted reques… |
CVE-2025-65798 | Medium | 5.4 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users. |
CVE-2025-65796 | Medium | 4.3 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos. |
CVE-2024-21635 | High | 7.5 | 2025-11-14 | Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the e… |
CVE-2025-56761 | Medium | 5.4 | 2025-09-03 | Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the cont… |
CVE-2025-56760 | Medium | 4.3 | 2025-09-03 | When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in t… |
CVE-2025-50738 | Critical | 9.8 | 2025-07-29 | The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an imag… |
CVE-2025-22952 | Critical | 9.8 | 2025-02-27 | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perfo… |
CVE-2023-0109 | Medium | 5.4 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript… |
CVE-2024-41659 | High | 8.1 | 2024-08-20 | memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected wi… |
CVE-2024-29029 | Medium | 6.1 | 2024-04-19 | memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users… |
CVE-2024-29030 | Medium | 5.8 | 2024-04-19 | memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users t… |
CVE-2024-29028 | Medium | 5.8 | 2024-04-19 | memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated use… |
CVE-2023-5036 | High | 8.8 | 2023-09-18 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1. |
CVE-2023-4698 | High | 7.5 | 2023-09-01 | Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4697 | High | 8.8 | 2023-09-01 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2023-4696 | Critical | 9.8 | 2023-09-01 | Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2022-25978 | Medium | 5.4 | 2023-02-15 | All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, whi… |
CVE-2023-0112 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0111 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0110 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0108 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0107 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2023-0106 | Medium | 5.4 | 2023-01-07 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0. |
CVE-2022-4866 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4865 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4863 | Medium | 6.5 | 2022-12-30 | Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4851 | Medium | 5.3 | 2022-12-29 | Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4850 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4849 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4848 | Medium | 5.7 | 2022-12-29 | Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4847 | Medium | 6.5 | 2022-12-29 | Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4846 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4845 | Medium | 4.3 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4844 | High | 8.8 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4841 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4840 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4839 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4814 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4813 | Medium | 4.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4812 | Medium | 6.5 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4811 | High | 8.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.
|
CVE-2022-4810 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4809 | High | 8.8 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4808 | High | 8.8 | 2022-12-28 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4807 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4806 | Medium | 5.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4805 | Medium | 4.3 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4804 | Medium | 5.3 | 2022-12-28 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4803 | High | 8.8 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4802 | Medium | 5.4 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4801 | Medium | 5.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4800 | Medium | 6.5 | 2022-12-28 | Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4799 | Medium | 6.5 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4798 | Medium | 5.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4797 | Medium | 4.3 | 2022-12-28 | Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4796 | High | 8.1 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4767 | High | 7.5 | 2022-12-27 | Denial of Service in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4734 | High | 8.1 | 2022-12-27 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
|
CVE-2022-4695 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4694 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4691 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4692 | Medium | 5.4 | 2022-12-23 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4690 | Medium | 5.4 | 2022-12-23 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4689 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4688 | High | 8.8 | 2022-12-23 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4687 | High | 8.1 | 2022-12-23 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4686 | Critical | 9.8 | 2022-12-23 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4684 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4683 | Medium | 6.5 | 2022-12-23 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4609 | Medium | 5.4 | 2022-12-19 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |