What’s Vulnerable › Products

usememos/memos vulnerabilities

79 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your usememos/memos version is affected

Latest usememos/memos vulnerabilities

• CVE-2026-113601 — Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity (CVSS 4.3)
• CVE-2026-84203 — Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change (CVSS 8.1)
• CVE-2026-82476 — Memos through 0.30.0 SSRF via Omitted CGNAT Address Range (CVSS 5.3)
• CVE-2026-71272 — Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() (CVSS 8.5)
• CVE-2026-71271 — Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass (CVSS 8.5)
• CVE-2026-6634 — usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization (CVSS 6.3)
• CVE-2025-65799 — (CVSS 4.3)
• CVE-2025-65797 — (CVSS 6.5)
• CVE-2025-65795 — (CVSS 7.5)
• CVE-2025-65798 — (CVSS 5.4)
• CVE-2025-65796 — (CVSS 4.3)
• CVE-2024-21635 — Memos Access Tokens Stay Valid after User Password Change (CVSS 7.5)
• CVE-2025-56761 — (CVSS 5.4)
• CVE-2025-56760 — (CVSS 4.3)
• CVE-2025-50738 — (CVSS 9.8)
• CVE-2025-22952 — (CVSS 9.8)
• CVE-2023-0109 — Stored XSS in usememos/memos (CVSS 5.4)
• CVE-2024-41659 — GHSL-2024-034: memos CORS Misconfiguration in server.go (CVSS 8.1)
• CVE-2024-29029 — memos vulnerable to an SSRF in /o/get/image (CVSS 6.1)
• CVE-2024-29030 — memos vulnerable to an SSRF in /api/resource (CVSS 5.3)
• CVE-2024-29028 — memos vulnerable to an SSRF in /o/get/httpmeta (CVSS 5.3)
• CVE-2023-5036 — Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 8.8)
• CVE-2023-4698 — Improper Input Validation in usememos/memos (CVSS 7.5)
• CVE-2023-4697 — Improper Privilege Management in usememos/memos (CVSS 8.8)
• CVE-2023-4696 — Improper Access Control in usememos/memos (CVSS 9.8)