Vendor
usememos
69 known vulnerabilities.
usememos at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 3 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
69 results · Feed
-
Medium 4.3
Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activit…
-
High 8.1
Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate …
-
Medium 5.3
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range incl…
-
High 8.5
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()
Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origi…
-
High 8.5
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/h…
-
Medium 6.3
usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization
A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript causes improper auth…
-
High 7.1
Memos Access Tokens Stay Valid after User Password Change
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has…
-
Critical 9.8
Stored XSS in usememos/memos
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed,…
-
High 8.1
GHSL-2024-034: memos CORS Misconfiguration in server.go
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross…
-
Medium 6.1
memos vulnerable to an SSRF in /o/get/image
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then c…
-
Medium 5.8
memos vulnerable to an SSRF in /o/get/httpmeta
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerabilit…
-
Medium 5.8
memos vulnerable to an SSRF in /api/resource
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.
-
High 7.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
-
High 8.8
Improper Privilege Management in usememos/memos
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
-
High 7.5CVE-2023-4698 Public exploit
Improper Input Validation in usememos/memos
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
-
Critical 9.8CVE-2023-4696 Public exploit
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
-
High 7.6
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
-
High 7.1
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
-
High 7.1
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
-
Critical 9.8
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.3
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.4
Improper Handling of Insufficient Permissions or Privileges in usememos/memos
Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.3
Incorrectly Specified Destination in a Communication Channel in usememos/memos
Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Improper Verification of Source of a Communication Channel in usememos/memos
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.0
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.6
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.7
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
Critical 9.8
Improper Handling of Values in usememos/memos
Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.3
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in usememos/memos
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.1
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.3
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.6
Insufficient Granularity of Access Control in usememos/memos
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.