Usememos Memos
78 CVEs affecting Usememos Memos. Latest disclosed: 2026-09-01. Critical: 6, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50738 | Critical | 9.8 | 2025-07-29 | The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an imag… |
CVE-2025-22952 | Critical | 9.8 | 2025-02-27 | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perfo… |
CVE-2023-4696 | Critical | 9.8 | 2023-09-01 | Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2022-4686 | Critical | 9.8 | 2022-12-23 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4866 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4865 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2023-5036 | High | 8.8 | 2023-09-18 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1. |
CVE-2023-4697 | High | 8.8 | 2023-09-01 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2. |
CVE-2022-4844 | High | 8.8 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4809 | High | 8.8 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4808 | High | 8.8 | 2022-12-28 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4803 | High | 8.8 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4689 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4688 | High | 8.8 | 2022-12-23 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4684 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2026-71272 | High | 8.5 | 2026-08-05 | Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates th… |
CVE-2026-71271 | High | 8.5 | 2026-08-05 | Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never c… |
CVE-2022-4811 | High | 8.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1. |
CVE-2026-84203 | High | 8.1 | 2026-09-01 | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attack… |
CVE-2024-41659 | High | 8.1 | 2024-08-20 | memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected wi… |