Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/usememos/memos

74 known vulnerabilities (9 critical, 44 high, 21 medium), with the versions each affects and the releases that fix them.

Latest release
v0.31.0 (Sep 19, 2026): affected by 6 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
74 · 9 critical, 44 high, 21 medium
Releases
96 since v0.1.3 (Jul 1, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 74 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 74

  • CVE-2026-6634Medium 5.3

    usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization

    Affected: through 0.22.1; all versions.

    No fix released. The latest release, v0.31.0, is still affected.

  • CVE-2025-65799Medium 4.3

    A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path…

    Affected: fixed in 0.25.3.

    Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2025-65798Medium 5.4

    Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments…

    Affected: fixed in 0.25.3.

    Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2025-65797Medium 6.5

    Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to…

    Affected: fixed in 0.25.3.

    Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2025-65796Medium 4.3

    Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to…

    Affected: fixed in 0.25.3.

    Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts…

    Affected: fixed in 0.25.3.

    Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • Memos Access Tokens Stay Valid after User Password Change

    Affected: all versions; fixed in 0.18.2.

    No fix released. The latest release, v0.31.0, is still affected.

  • CVE-2025-56761Medium 5.4

    Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.

    Affected: all versions; through 0.22.0.

    No fix released. The latest release, v0.31.0, is still affected.

  • CVE-2025-56760Medium 4.3

    When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path…

    Affected: through 0.22.0; all versions.

    No fix released. The latest release, v0.31.0, is still affected.

  • CVE-2025-50738Critical 9.8

    The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.

    Affected: fixed in 0.24.4.

    Fixed in v0.24.4 (released Jun 2, 2025, 57 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2025-22952Critical 9.8

    elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can…

    Affected: through 0.24.0; all versions.

    No fix released. The latest release, v0.31.0, is still affected.

  • CVE-2023-0109Critical 9.8

    Stored XSS in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, 678 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • GHSL-2024-034: memos CORS Misconfiguration in server.go

    Affected: fixed in 0.21.0.

    Fixed in v0.21.0 (released Apr 9, 2024, 133 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2024-29029Medium 6.1

    memos vulnerable to an SSRF in /o/get/image

    Affected: fixed in 0.22.0.

    Fixed in v0.22.0 (released May 17, 2024, 28 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2024-29028Medium 5.8

    memos vulnerable to an SSRF in /o/get/httpmeta

    Affected: fixed in 0.16.1.

    Fixed in v0.16.1 (released Oct 21, 2023, 181 days before disclosure).

    The latest release, v0.31.0, is not affected.

Show all 74 advisoriesShow fewer advisories
  • CVE-2024-29030Medium 5.8

    memos vulnerable to an SSRF in /api/resource

    Affected: fixed in 0.22.0.

    Fixed in v0.22.0 (released May 17, 2024, 28 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-Site Request Forgery (CSRF) in usememos/memos

    Affected: fixed in 0.15.1.

    Fixed in v0.15.1 (released Sep 18, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Privilege Management in usememos/memos

    Affected: fixed in 0.13.2.

    Fixed in v0.13.2 (released Jul 1, 2023, 62 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Input Validation in usememos/memos

    Affected: all versions.

    No fix released. The latest release, v0.31.0, is still affected.

  • CVE-2023-4696Critical 9.8

    Improper Access Control in usememos/memos

    Affected: fixed in 0.13.2.

    Fixed in v0.13.2 (released Jul 1, 2023, 62 days before disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-25978Medium 5.4

    All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on…

    Affected: fixed in 0.10.4-0.20230211093429-b11d2130a084.

    Fixed in v0.11.0 (released Feb 24, 2023, 9 days after disclosure, the advisory names 0.10.4-0.20230211093429-b11d2130a084, which was never published).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2023-0111Medium 5.4

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2023-0107Medium 6.5

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2023-0106Critical 9.0

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.10.0.

    Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4866Critical 9.8

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Handling of Insufficient Permissions or Privileges in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 1 day after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4851Critical 9.8

    Improper Handling of Values in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4850Medium 6.5

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Affected: through 0.9.0.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v0.31.0, is not affected.

  • Cross-Site Request Forgery (CSRF) in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Verification of Source of a Communication Channel in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Incorrectly Specified Destination in a Communication Channel in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4846Medium 6.3

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Affected: through 0.9.0.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4845Medium 6.7

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4844Medium 6.5

    Cross-Site Request Forgery (CSRF) in usememos/memos

    Affected: through 0.9.0.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Access Control in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Insufficient Granularity of Access Control in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4810Medium 6.3

    Improper Access Control in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Access Control in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4808Medium 4.2

    Improper Privilege Management in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Access Control in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Incorrect Use of Privileged APIs in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Authorization in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4802Critical 9.1

    Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Insufficient Granularity of Access Control in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Verification of Source of a Communication Channel in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4797Critical 9.8

    Improper Restriction of Excessive Authentication Attempts in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Incorrect Use of Privileged APIs in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Denial of Service in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 4 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos

    Affected: fixed in 0.9.1.

    Fixed in v0.9.1 (released Dec 31, 2022, 6 days after disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4694Medium 5.7

    Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Access Control in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Authorization in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Incorrect Use of Privileged APIs in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Authorization Bypass Through User-Controlled Key in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Improper Access Control in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • CVE-2022-4683Medium 4.3

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos

    Affected: fixed in 0.9.0.

    Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).

    The latest release, v0.31.0, is not affected.

  • Cross-site Scripting (XSS) - Stored in usememos/memos

    Affected: through 0.8.3.

    Fixed in v0.9.0 (released Dec 23, 2022, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, v0.31.0, is not affected.