Priority LOW 19
A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00229 · Published 2025-12-08 · Fixed in 0.25.3 CWE-73
Priority MEDIUM 58
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00193 · Published 2025-12-08 · Fixed in 0.25.3 CWE-284
Priority MEDIUM 62
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2025-12-08 · Fixed in 0.25.3 CWE-284
Priority MEDIUM 53
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00213 · Published 2025-12-08 · Fixed in 0.25.3 CWE-284
Priority HIGH 72
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00276 · Published 2025-12-08 · Fixed in 0.25.3 CWE-284
Priority MEDIUM 64
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00307 · Published 2025-11-14 · Fixed in 0.18.2 CWE-287
Priority MEDIUM 58
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0027 · Published 2025-09-03 · No fix listed CWE-79
Priority LOW 20
When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00351 · Published 2025-09-03 · No fix listed CWE-24
Priority HIGH 82
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02423 · Published 2025-07-29 · Fixed in 0.24.4 CWE-200
Priority HIGH 82
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02932 · Published 2025-02-27 · No fix listed CWE-918
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00463 · Published 2024-11-15 · Fixed in 0.10.0 CWE-79
Priority HIGH 74
memos is a privacy-first, lightweight note-taking service.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00643 · Published 2024-08-20 · Fixed in 0.21.0 CWE-942
Priority LOW 29
memos is a privacy-first, lightweight note-taking service.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0108 · Published 2024-04-19 · Fixed in 0.22.0 CWE-79
Priority HIGH 65
memos is a privacy-first, lightweight note-taking service.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.01049 · Published 2024-04-19 · Fixed in 0.16.1 CWE-918
Priority HIGH 65
memos is a privacy-first, lightweight note-taking service.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2024-04-19 · Fixed in 0.22.0 CWE-918
Priority HIGH 73
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00316 · Published 2023-09-18 · Fixed in 0.15.1 CWE-352
Priority HIGH 73
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00846 · Published 2023-09-01 · Fixed in 0.13.2 CWE-269
Priority HIGH 72
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00916 · Published 2023-09-01 · Fixed in 0.13.2 CWE-20
Priority HIGH 82
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0112 · Published 2023-09-01 · Fixed in 0.13.2 CWE-284
Priority MEDIUM 60
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00534 · Published 2023-02-15 · Fixed in 0.10.4-0.20230211093429-b11d2130a084 CWE-79
Priority HIGH 66
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00614 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Priority HIGH 66
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00531 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Priority HIGH 66
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00531 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Priority LOW 33
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00554 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Priority HIGH 66
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00531 · Published 2023-01-07 · Fixed in 0.10.0 CWE-79
Load more
THREATIST.IORead the docs