Usememos

Memos

77 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.5

CVE-2026-71272

  • EPSS 0.17%
  • Veröffentlicht 05.08.2026 12:26:19
  • Zuletzt bearbeitet 10.08.2026 12:17:29

Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using ...

8.5

CVE-2026-71271

  • EPSS 0.24%
  • Veröffentlicht 05.08.2026 12:26:18
  • Zuletzt bearbeitet 10.08.2026 12:17:29

Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in i...

6.1

CVE-2026-30586

  • EPSS 0.22%
  • Veröffentlicht 02.06.2026 00:00:00
  • Zuletzt bearbeitet 22.07.2026 19:10:00

Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE_SCHEMA, Memo Rendering Component, and Public/Private Memo View pages

6.3

CVE-2026-6634

Exploit
  • EPSS 0.25%
  • Veröffentlicht 20.04.2026 11:30:13
  • Zuletzt bearbeitet 29.04.2026 01:00:01

A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript causes impr...

5.4

CVE-2025-65798

Exploit
  • EPSS 0.18%
  • Veröffentlicht 08.12.2025 00:00:00
  • Zuletzt bearbeitet 05.07.2026 17:17:24

Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.

4.3

CVE-2025-65796

Exploit
  • EPSS 0.19%
  • Veröffentlicht 08.12.2025 00:00:00
  • Zuletzt bearbeitet 05.07.2026 17:17:23

Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.

7.5

CVE-2025-65795

Exploit
  • EPSS 0.25%
  • Veröffentlicht 08.12.2025 00:00:00
  • Zuletzt bearbeitet 05.07.2026 17:17:23

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

6.5

CVE-2025-65797

Exploit
  • EPSS 0.27%
  • Veröffentlicht 08.12.2025 00:00:00
  • Zuletzt bearbeitet 05.07.2026 17:17:24

Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).

4.3

CVE-2025-65799

Exploit
  • EPSS 0.21%
  • Veröffentlicht 08.12.2025 00:00:00
  • Zuletzt bearbeitet 05.07.2026 17:17:24

A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.

7.5

CVE-2024-21635

Exploit
  • EPSS 0.28%
  • Veröffentlicht 14.11.2025 14:11:38
  • Zuletzt bearbeitet 26.11.2025 16:05:49

Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their ac...