Usememos vulnerabilities
69 CVEs and advisories name Usememos as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-113601Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
- CVE-2026-84203Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
- CVE-2026-82476Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
- CVE-2026-71272Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()
- CVE-2026-71271Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
- CVE-2026-6634usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization
- CVE-2024-21635Memos Access Tokens Stay Valid after User Password Change
- CVE-2023-0109Stored XSS in usememos/memos
- CVE-2024-41659GHSL-2024-034: memos CORS Misconfiguration in server.go
- CVE-2024-29029memos vulnerable to an SSRF in /o/get/image
- CVE-2024-29028memos vulnerable to an SSRF in /o/get/httpmeta
- CVE-2024-29030memos vulnerable to an SSRF in /api/resource
- CVE-2023-5036Cross-Site Request Forgery (CSRF) in usememos/memos
- CVE-2023-4697Improper Privilege Management in usememos/memos
- CVE-2023-4698Improper Input Validation in usememos/memos
- CVE-2023-4696Improper Access Control in usememos/memos
- CVE-2023-0112Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2023-0111Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2023-0110Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2023-0108Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2023-0107Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2023-0106Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2022-4866Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2022-4865Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2022-4863Improper Handling of Insufficient Permissions or Privileges in usememos/memos
- CVE-2022-4851Improper Handling of Values in usememos/memos
- CVE-2022-4850Cross-Site Request Forgery (CSRF) in usememos/memos
- CVE-2022-4849Cross-Site Request Forgery (CSRF) in usememos/memos
- CVE-2022-4848Improper Verification of Source of a Communication Channel in usememos/memos
- CVE-2022-4847Incorrectly Specified Destination in a Communication Channel in usememos/memos