# cve.now: Usememos

The newest entries naming Usememos as an affected vendor (up to 200), of 69 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-113601](https://cve.now/CVE-2026-113601.md): Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity (CVSS 5.3)
- [CVE-2026-84203](https://cve.now/CVE-2026-84203.md): Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change (CVSS 8.6)
- [CVE-2026-82476](https://cve.now/CVE-2026-82476.md): Memos through 0.30.0 SSRF via Omitted CGNAT Address Range (CVSS 6.9)
- [CVE-2026-71272](https://cve.now/CVE-2026-71272.md): Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() (CVSS 8.5)
- [CVE-2026-71271](https://cve.now/CVE-2026-71271.md): Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass (CVSS 8.5)
- [CVE-2026-6634](https://cve.now/CVE-2026-6634.md): usememos UpdateInstanceSetting App.tsx memos\_access\_token improper authorization (CVSS 5.3)
- [CVE-2024-21635](https://cve.now/CVE-2024-21635.md): Memos Access Tokens Stay Valid after User Password Change (CVSS 7.1)
- [CVE-2023-0109](https://cve.now/CVE-2023-0109.md): Stored XSS in usememos/memos (CVSS 9.8)
- [CVE-2024-41659](https://cve.now/CVE-2024-41659.md): GHSL-2024-034: memos CORS Misconfiguration in server.go (CVSS 8.1)
- [CVE-2024-29029](https://cve.now/CVE-2024-29029.md): memos vulnerable to an SSRF in /o/get/image (CVSS 6.1)
- [CVE-2024-29028](https://cve.now/CVE-2024-29028.md): memos vulnerable to an SSRF in /o/get/httpmeta (CVSS 5.8)
- [CVE-2024-29030](https://cve.now/CVE-2024-29030.md): memos vulnerable to an SSRF in /api/resource (CVSS 5.8)
- [CVE-2023-5036](https://cve.now/CVE-2023-5036.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 7.3)
- [CVE-2023-4697](https://cve.now/CVE-2023-4697.md): Improper Privilege Management in usememos/memos (CVSS 8.8)
- [CVE-2023-4698](https://cve.now/CVE-2023-4698.md): Improper Input Validation in usememos/memos (CVSS 7.5)
- [CVE-2023-4696](https://cve.now/CVE-2023-4696.md): Improper Access Control in usememos/memos (CVSS 9.8)
- [CVE-2023-0112](https://cve.now/CVE-2023-0112.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6)
- [CVE-2023-0111](https://cve.now/CVE-2023-0111.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 5.4)
- [CVE-2023-0110](https://cve.now/CVE-2023-0110.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.1)
- [CVE-2023-0108](https://cve.now/CVE-2023-0108.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.1)
- [CVE-2023-0107](https://cve.now/CVE-2023-0107.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 6.5)
- [CVE-2023-0106](https://cve.now/CVE-2023-0106.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 9.0)
- [CVE-2022-4866](https://cve.now/CVE-2022-4866.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 9.8)
- [CVE-2022-4865](https://cve.now/CVE-2022-4865.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.3)
- [CVE-2022-4863](https://cve.now/CVE-2022-4863.md): Improper Handling of Insufficient Permissions or Privileges in usememos/memos (CVSS 8.4)
- [CVE-2022-4851](https://cve.now/CVE-2022-4851.md): Improper Handling of Values in usememos/memos (CVSS 9.8)
- [CVE-2022-4850](https://cve.now/CVE-2022-4850.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.5)
- [CVE-2022-4849](https://cve.now/CVE-2022-4849.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 8.3)
- [CVE-2022-4848](https://cve.now/CVE-2022-4848.md): Improper Verification of Source of a Communication Channel in usememos/memos (CVSS 8.6)
- [CVE-2022-4847](https://cve.now/CVE-2022-4847.md): Incorrectly Specified Destination in a Communication Channel in usememos/memos (CVSS 8.3)
- [CVE-2022-4846](https://cve.now/CVE-2022-4846.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.3)
- [CVE-2022-4845](https://cve.now/CVE-2022-4845.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.7)
- [CVE-2022-4844](https://cve.now/CVE-2022-4844.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.5)
- [CVE-2022-4841](https://cve.now/CVE-2022-4841.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.6)
- [CVE-2022-4840](https://cve.now/CVE-2022-4840.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6)
- [CVE-2022-4839](https://cve.now/CVE-2022-4839.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.0)
- [CVE-2022-4814](https://cve.now/CVE-2022-4814.md): Improper Access Control in usememos/memos (CVSS 8.6)
- [CVE-2022-4813](https://cve.now/CVE-2022-4813.md): Insufficient Granularity of Access Control in usememos/memos (CVSS 8.6)
- [CVE-2022-4812](https://cve.now/CVE-2022-4812.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6)
- [CVE-2022-4811](https://cve.now/CVE-2022-4811.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.3)
- [CVE-2022-4810](https://cve.now/CVE-2022-4810.md): Improper Access Control in usememos/memos (CVSS 6.3)
- [CVE-2022-4809](https://cve.now/CVE-2022-4809.md): Improper Access Control in usememos/memos (CVSS 8.3)
- [CVE-2022-4808](https://cve.now/CVE-2022-4808.md): Improper Privilege Management in usememos/memos (CVSS 4.2)
- [CVE-2022-4807](https://cve.now/CVE-2022-4807.md): Improper Access Control in usememos/memos (CVSS 8.2)
- [CVE-2022-4806](https://cve.now/CVE-2022-4806.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.2)
- [CVE-2022-4805](https://cve.now/CVE-2022-4805.md): Incorrect Use of Privileged APIs in usememos/memos (CVSS 7.3)
- [CVE-2022-4804](https://cve.now/CVE-2022-4804.md): Improper Authorization in usememos/memos (CVSS 8.2)
- [CVE-2022-4803](https://cve.now/CVE-2022-4803.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.1)
- [CVE-2022-4802](https://cve.now/CVE-2022-4802.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 9.1)
- [CVE-2022-4801](https://cve.now/CVE-2022-4801.md): Insufficient Granularity of Access Control in usememos/memos (CVSS 8.2)
- [CVE-2022-4800](https://cve.now/CVE-2022-4800.md): Improper Verification of Source of a Communication Channel in usememos/memos (CVSS 8.6)
- [CVE-2022-4799](https://cve.now/CVE-2022-4799.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6)
- [CVE-2022-4798](https://cve.now/CVE-2022-4798.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6)
- [CVE-2022-4797](https://cve.now/CVE-2022-4797.md): Improper Restriction of Excessive Authentication Attempts in usememos/memos (CVSS 9.8)
- [CVE-2022-4796](https://cve.now/CVE-2022-4796.md): Incorrect Use of Privileged APIs in usememos/memos (CVSS 8.1)
- [CVE-2022-4767](https://cve.now/CVE-2022-4767.md): Denial of Service in usememos/memos (CVSS 7.6)
- [CVE-2022-4734](https://cve.now/CVE-2022-4734.md): Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos (CVSS 8.1)
- [CVE-2022-4695](https://cve.now/CVE-2022-4695.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6)
- [CVE-2022-4694](https://cve.now/CVE-2022-4694.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 5.7)
- [CVE-2022-4692](https://cve.now/CVE-2022-4692.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.1)
- [CVE-2022-4691](https://cve.now/CVE-2022-4691.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.3)
- [CVE-2022-4690](https://cve.now/CVE-2022-4690.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.1)
- [CVE-2022-4689](https://cve.now/CVE-2022-4689.md): Improper Access Control in usememos/memos (CVSS 8.3)
- [CVE-2022-4688](https://cve.now/CVE-2022-4688.md): Improper Authorization in usememos/memos (CVSS 8.8)
- [CVE-2022-4687](https://cve.now/CVE-2022-4687.md): Incorrect Use of Privileged APIs in usememos/memos (CVSS 8.1)
- [CVE-2022-4686](https://cve.now/CVE-2022-4686.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6)
- [CVE-2022-4684](https://cve.now/CVE-2022-4684.md): Improper Access Control in usememos/memos (CVSS 7.6)
- [CVE-2022-4683](https://cve.now/CVE-2022-4683.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos (CVSS 4.3)
- [CVE-2022-4609](https://cve.now/CVE-2022-4609.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/usememos
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.