11
CVEs
0
Critical
5
High
0
KEV
7
PoC
3
Unpatched C/H
54.5%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
5
MEDIUM
5
LOW
1
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-65795 | Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request. | HIGH | 7.5 | 0.0% | 58 |
PoC
|
| CVE-2025-65797 | Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS). | MEDIUM | 6.5 | 0.1% | 53 |
PoC
|
| CVE-2025-65798 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users. | MEDIUM | 5.4 | 0.0% | 47 |
PoC
|
| CVE-2026-84203 | Persistent account takeover in Memos 0.26.0-0.30.0 is enabled by a failure to invalidate refresh tokens upon password change. An attacker who possesses a stolen refresh token can indefinitely call the RefreshToken RPC to rotate both the refresh token and obtain fresh access tokens, making the victim's password-change security response completely ineffective. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to exploit once a token is obtained, and CVSS 4.0 rates the impact as High on both confidentiality and integrity. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-71271 | Webhook URL validation bypass in Memos allows authenticated users to trigger Server-Side Request Forgery via the 0.0.0.0 address notation, causing the server to make outbound HTTP requests to its own loopback interface and exposing internal-only services, with a CVSS 8.5 score reflecting Changed Scope and High Confidentiality impact. The root cause is a code-divergence defect: isReservedIP() in internal/webhook/validate.go omits the 0.0.0.0/8 CIDR block and never calls ip.IsUnspecified(), while the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go does both. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and standard SSRF-to-loopback technique make this a realistic risk on any Linux-hosted Memos instance with multi-user access. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-71272 | DNS rebinding bypass of SSRF protection in Memos' webhook dispatcher allows a low-privileged authenticated attacker to reach internal network resources by exploiting a time-of-check/time-of-use race in hostname resolution. The `safeDialContext()` function in `internal/webhook/webhook.go` validates the resolved IP against reserved ranges but then re-dials using the original hostname, allowing the underlying `net.Dialer.DialContext()` to perform a second, independent DNS lookup that the attacker controls. By setting a short TTL on an attacker-controlled domain and swapping the DNS response between validation and dial, an attacker can cause Memos to connect to arbitrary internal addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope change (S:C) and high confidentiality impact reflect the risk of internal service enumeration and data exfiltration. | HIGH | 8.5 | 0.2% | 43 |
No patch
|
| CVE-2025-65799 | A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal. | MEDIUM | 4.3 | 0.0% | 42 |
PoC
|
| CVE-2025-65796 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos. | MEDIUM | 4.3 | 0.0% | 42 |
PoC
|
| CVE-2026-82476 | Server-side request forgery in Memos through 0.30.0 allows unauthenticated remote attackers to make the application's link-metadata fetcher issue HTTP requests to hosts in the 100.64.0.0/10 carrier-grade NAT address space, a range the application's IP blocklist incorrectly omits. The server returns page titles and HTML meta descriptions from targeted internal hosts, enabling partial reconnaissance of CGNAT-addressed infrastructure. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-6634 | Improper authorization in usememos memos up to version 0.22.1 allows authenticated remote attackers to bypass access controls via manipulation of additionalStyle and additionalScript arguments in the UpdateInstanceSetting component, potentially leading to unauthorized information disclosure, modification, and service disruption. The vulnerability has publicly available exploit code and affects the memos_access_token function in src/App.tsx. The vendor did not respond to early disclosure efforts. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2024-21635 | Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.1 | 0.1% | – |
PoC
|