What’s Vulnerable › Vulnerabilities

CVE-2026-51583

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-918

Description

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.

References

• https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80
• https://github.com/usememos/memos
• https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80

Get alerted when CVE-2026-51583 or the next vulnerability affects your stack