Priority HIGH 82
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02423 · Published 2025-07-29 · Fixed in 0.24.4 CWE-200
Priority HIGH 82
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02932 · Published 2025-02-27 · No fix listed CWE-918
Priority HIGH 82
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0112 · Published 2023-09-01 · Fixed in 0.13.2 CWE-284
Priority HIGH 80
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.01058 · Published 2022-12-31 · Fixed in 0.9.1 CWE-79
Priority HIGH 80
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.01058 · Published 2022-12-31 · Fixed in 0.9.1 CWE-79
Priority HIGH 75
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00781 · Published 2022-12-23 · Fixed in 0.9.0 CWE-639
Priority HIGH 74
memos is a privacy-first, lightweight note-taking service.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00643 · Published 2024-08-20 · Fixed in 0.21.0 CWE-942
Priority HIGH 73
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00316 · Published 2023-09-18 · Fixed in 0.15.1 CWE-352
Priority HIGH 73
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00846 · Published 2023-09-01 · Fixed in 0.13.2 CWE-269
Priority HIGH 72
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00257 · Published 2025-12-08 · Fixed in 0.25.3 CWE-284
Priority HIGH 72
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00916 · Published 2023-09-01 · Fixed in 0.13.2 CWE-20
Priority HIGH 71
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00328 · Published 2022-12-29 · Fixed in 0.9.1 CWE-352
Priority HIGH 71
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00973 · Published 2022-12-28 · Fixed in 0.9.1 CWE-284
Priority HIGH 71
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0045 · Published 2022-12-28 · Fixed in 0.9.1 CWE-269
Priority HIGH 71
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00866 · Published 2022-12-28 · Fixed in 0.9.1 CWE-639
Priority HIGH 71
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00791 · Published 2022-12-23 · Fixed in 0.9.0 CWE-284
Priority HIGH 71
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00791 · Published 2022-12-23 · Fixed in 0.9.0 CWE-285
Priority HIGH 71
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00648 · Published 2022-12-23 · Fixed in 0.9.0 CWE-284
Priority HIGH 70
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00427 · Published 2026-08-29 · No fix listed CWE-918
Priority HIGH 69
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00602 · Published 2022-12-28 · Fixed in 0.9.1 CWE-639
Priority HIGH 68
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00812 · Published 2022-12-28 · Fixed in 0.9.1 CWE-648
Priority HIGH 68
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00825 · Published 2022-12-25 · Fixed in 0.9.1 CWE-212
Priority HIGH 68
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00676 · Published 2022-12-23 · Fixed in 0.9.0 CWE-648
Priority HIGH 66
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00614 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Priority HIGH 66
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00531 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Load more
THREATIST.IORead the docs