受影响的版本系列
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-113601 | Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity | < 0.27.0 | 5.3 | — | 2026-10-21 | |
| CVE-2026-84203 | Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change | ≥ 0.26.0 ≤ 0.30.0 | 8.6 | — | 2026-09-02 | |
| CVE-2026-82476 | Memos through 0.30.0 SSRF via Omitted CGNAT Address Range | ≤ 0.30.0 | 6.9 | — | 2026-08-30 | |
| CVE-2026-51584 | An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branc... | * | 9.8 | — | 2026-08-11 | |
| CVE-2026-51583 | An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request For... | * | 8.5 | — | 2026-08-11 | |
| CVE-2026-71272 | Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() | ≤ 0.29.1 | 8.5 | — | 2026-08-05 | |
| CVE-2026-71271 | Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass | ≤ 0.29.1 | 8.5 | — | 2026-08-05 | |
| CVE-2026-30586 | Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive inf... | * | 6.1 | — | 2026-06-02 | |
| CVE-2026-6634 | usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization | = 0.22.0 = 0.22.1 | 5.3 | — | 2026-04-20 | |
| CVE-2025-65797 | Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-... | * = 0.25.2 | 6.5 | — | 2025-12-08 | |
| CVE-2025-65799 | A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows atta... | * = 0.25.2 | 4.3 | — | 2025-12-08 | |
| CVE-2025-65795 | Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers... | * = 0.25.2 | 7.5 | — | 2025-12-08 | |
| CVE-2025-65796 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily d... | * = 0.25.2 | 4.3 | — | 2025-12-08 | |
| CVE-2025-65798 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily m... | * = 0.25.2 | 5.4 | — | 2025-12-08 | |
| CVE-2024-21635 | Memos Access Tokens Stay Valid after User Password Change | * ≤ 0.18.1 | 7.1 | — | 2025-11-14 | |
| CVE-2025-56760 | When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource e... | * = 0.22.0 | 4.3 | — | 2025-09-03 | |
| CVE-2025-56761 | Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and use... | * = 0.22.0 | 5.4 | — | 2025-09-03 | |
| CVE-2025-50738 | The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.... | * ≤ 0.24.3 | 9.8 | — | 2025-07-29 | |
| CVE-2025-22952 | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of us... | * = 0.23.0 | 9.8 | — | 2025-02-27 | |
| CVE-2023-0109 | Stored XSS in usememos/memos | * = 0.9.1 | 5.4 | — | 2024-11-15 | |
| CVE-2024-41659 | GHSL-2024-034: memos CORS Misconfiguration in server.go | * < 0.21.0 | 8.1 | — | 2024-08-20 | |
| CVE-2024-29029 | memos vulnerable to an SSRF in /o/get/image | * < 0.22.0 | 6.1 | — | 2024-04-19 | |
| CVE-2024-29028 | memos vulnerable to an SSRF in /o/get/httpmeta | * ≥ 0.13.2 < 0.16.1 | 5.3 | — | 2024-04-19 | |
| CVE-2024-29030 | memos vulnerable to an SSRF in /api/resource | * ≥ 0.13.2 < 0.22.0 | 5.3 | — | 2024-04-19 | |
| CVE-2023-5036 | Cross-Site Request Forgery (CSRF) in usememos/memos | * < 0.15.1 | 8.8 | — | 2023-09-18 | |
| CVE-2023-4698 | Improper Input Validation in usememos/memos | * < 0.13.2 | 7.5 | — | 2023-09-01 | |
| CVE-2023-4697 | Improper Privilege Management in usememos/memos | * < 0.13.2 | 8.8 | — | 2023-09-01 | |
| CVE-2023-4696 | Improper Access Control in usememos/memos | * < 0.13.2 | 9.8 | — | 2023-09-01 | |
| CVE-2022-25978 | All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due... | * | 6.1 | — | 2023-02-15 | |
| CVE-2023-0112 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.10.0 | 5.4 | — | 2023-01-07 | |
| CVE-2023-0110 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.10.0 | 5.4 | — | 2023-01-07 | |
| CVE-2023-0108 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.10.0 | 5.4 | — | 2023-01-07 | |
| CVE-2023-0106 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.10.0 | 5.4 | — | 2023-01-07 | |
| CVE-2023-0107 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.10.0 | 5.4 | — | 2023-01-07 | |
| CVE-2023-0111 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.10.0 | 5.4 | — | 2023-01-07 | |
| CVE-2022-4866 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.9.1 | 9.0 | — | 2022-12-31 | |
| CVE-2022-4865 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.9.1 | 9.0 | — | 2022-12-31 | |
| CVE-2022-4863 | Improper Handling of Insufficient Permissions or Privileges in usememos/memos | * < 0.9.1 | 6.5 | — | 2022-12-30 | |
| CVE-2022-4845 | Cross-Site Request Forgery (CSRF) in usememos/memos | * < 0.9.1 | 4.3 | — | 2022-12-29 | |
| CVE-2022-4850 | Cross-Site Request Forgery (CSRF) in usememos/memos | * < 0.9.1 | 6.5 | — | 2022-12-29 | |
| CVE-2022-4848 | Improper Verification of Source of a Communication Channel in usememos/memos | * < 0.9.1 | 5.7 | — | 2022-12-29 | |
| CVE-2022-4846 | Cross-Site Request Forgery (CSRF) in usememos/memos | * < 0.9.1 | 6.5 | — | 2022-12-29 | |
| CVE-2022-4851 | Improper Handling of Values in usememos/memos | * < 0.9.1 | 5.3 | — | 2022-12-29 | |
| CVE-2022-4849 | Cross-Site Request Forgery (CSRF) in usememos/memos | * < 0.9.1 | 6.5 | — | 2022-12-29 | |
| CVE-2022-4847 | Incorrectly Specified Destination in a Communication Channel in usememos/memos | * < 0.9.1 | 6.5 | — | 2022-12-29 | |
| CVE-2022-4844 | Cross-Site Request Forgery (CSRF) in usememos/memos | * < 0.9.1 | 8.8 | — | 2022-12-29 | |
| CVE-2022-4841 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.9.1 | 5.4 | — | 2022-12-29 | |
| CVE-2022-4840 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.9.1 | 5.4 | — | 2022-12-29 | |
| CVE-2022-4839 | Cross-site Scripting (XSS) - Stored in usememos/memos | * < 0.9.1 | 5.4 | — | 2022-12-29 | |
| CVE-2022-4813 | Insufficient Granularity of Access Control in usememos/memos | * < 0.9.1 | 4.3 | — | 2022-12-28 | |
| CVE-2022-4814 | Improper Access Control in usememos/memos | * < 0.9.1 | 4.3 | — | 2022-12-28 | |
| CVE-2022-4808 | Improper Privilege Management in usememos/memos | * < 0.9.1 | 8.8 | — | 2022-12-28 | |
| CVE-2022-4806 | Authorization Bypass Through User-Controlled Key in usememos/memos | * < 0.9.1 | 5.3 | — | 2022-12-28 | |
| CVE-2022-4809 | Improper Access Control in usememos/memos | * < 0.9.1 | 8.8 | — | 2022-12-28 | |
| CVE-2022-4810 | Improper Access Control in usememos/memos | * < 0.9.1 | 4.3 | — | 2022-12-28 | |
| CVE-2022-4812 | Authorization Bypass Through User-Controlled Key in usememos/memos | * < 0.9.1 | 6.5 | — | 2022-12-28 | |
| CVE-2022-4807 | Improper Access Control in usememos/memos | * < 0.9.1 | 4.3 | — | 2022-12-28 | |
| CVE-2022-4811 | Authorization Bypass Through User-Controlled Key in usememos/memos | * < 0.9.1 | 5.4 | — | 2022-12-28 | |
| CVE-2022-4802 | Authorization Bypass Through User-Controlled Key in usememos/memos | * < 0.9.1 | 5.4 | — | 2022-12-28 | |
| CVE-2022-4797 | Improper Restriction of Excessive Authentication Attempts in usememos/memos | * < 0.9.1 | 4.3 | — | 2022-12-28 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。