4
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-84203 | Persistent account takeover in Memos 0.26.0-0.30.0 is enabled by a failure to invalidate refresh tokens upon password change. An attacker who possesses a stolen refresh token can indefinitely call the RefreshToken RPC to rotate both the refresh token and obtain fresh access tokens, making the victim's password-change security response completely ineffective. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to exploit once a token is obtained, and CVSS 4.0 rates the impact as High on both confidentiality and integrity. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-71271 | Webhook URL validation bypass in Memos allows authenticated users to trigger Server-Side Request Forgery via the 0.0.0.0 address notation, causing the server to make outbound HTTP requests to its own loopback interface and exposing internal-only services, with a CVSS 8.5 score reflecting Changed Scope and High Confidentiality impact. The root cause is a code-divergence defect: isReservedIP() in internal/webhook/validate.go omits the 0.0.0.0/8 CIDR block and never calls ip.IsUnspecified(), while the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go does both. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and standard SSRF-to-loopback technique make this a realistic risk on any Linux-hosted Memos instance with multi-user access. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-71272 | DNS rebinding bypass of SSRF protection in Memos' webhook dispatcher allows a low-privileged authenticated attacker to reach internal network resources by exploiting a time-of-check/time-of-use race in hostname resolution. The `safeDialContext()` function in `internal/webhook/webhook.go` validates the resolved IP against reserved ranges but then re-dials using the original hostname, allowing the underlying `net.Dialer.DialContext()` to perform a second, independent DNS lookup that the attacker controls. By setting a short TTL on an attacker-controlled domain and swapping the DNS response between validation and dial, an attacker can cause Memos to connect to arbitrary internal addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope change (S:C) and high confidentiality impact reflect the risk of internal service enumeration and data exfiltration. | HIGH | 8.5 | 0.2% | 43 |
No patch
|
| CVE-2026-82476 | Server-side request forgery in Memos through 0.30.0 allows unauthenticated remote attackers to make the application's link-metadata fetcher issue HTTP requests to hosts in the 100.64.0.0/10 carrier-grade NAT address space, a range the application's IP blocklist incorrectly omits. The server returns page titles and HTML meta descriptions from targeted internal hosts, enabling partial reconnaissance of CGNAT-addressed infrastructure. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|