usememos vulnerabilities

CVEs per yearBy the year they were published

1. 202247
2. 202310
3. 20245
4. 20251
5. 20266

Newest CVEs

• CVE-2026-113601

  Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

  usememos · memos

  Medium5.3
• CVE-2026-84203

  Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

  usememos · memos

  High8.6
• CVE-2026-82476

  Memos through 0.30.0 SSRF via Omitted CGNAT Address Range

  usememos · memos

  Medium6.9
• CVE-2026-71272

  Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

  usememos · memos

  High8.5
• CVE-2026-71271

  Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

  usememos · memos

  High8.5
• CVE-2026-6634

  usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization

  usememos · memos

  Medium5.3
• CVE-2024-21635

  Memos Access Tokens Stay Valid after User Password Change

  usememos · memos

  High7.1
• CVE-2023-0109

  Stored XSS in usememos/memos

  usememos · usememos/memos

  Critical9.8
• CVE-2024-41659

  GHSL-2024-034: memos CORS Misconfiguration in server.go

  usememos · memos

  High8.1
• CVE-2024-29029

  memos vulnerable to an SSRF in /o/get/image

  usememos · memos

  Medium6.1