HIGH8.8Go
GHSA-2g7r-9xq5-c6hv· CVE-2023-5036, GO-2023-2065Cross-Site Request Forgery (CSRF) in usememos/memos
Modified: 8/21/2024
package
Go/github.com/usememos/memos
pkg:go/github.com/usememos/memos
HIGH7.5Go
GHSA-33m8-f4hw-wm3q· CVE-2022-4767, GO-2022-1219usememos/memos Denial of Service vulnerability
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-42q2-m54f-jh95· CVE-2022-4851, GO-2023-1285sememos/memos vulnerable to Improper Handling of Values
Modified: 8/20/2024
HIGH8.8Go
GHSA-5j6p-59cj-j6cp· CVE-2023-4697, GO-2023-2036usememos/memos vulnerable to privilege escalation
Modified: 8/21/2024
HIGH8.8Go
GHSA-5jqp-wmhj-g33f· CVE-2022-4844usememos/memos Cross-Site Request Forgery vulnerability
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-5r2g-59px-3q9w· CVE-2023-0109, GO-2024-3274Stored XSS using two files in usememos/memos
Modified: 11/19/2024
MEDIUM6.5Go
GHSA-642q-2q68-9j3p· CVE-2022-4849, GO-2022-1250usememos/memos Cross-Site Request Forgery vulnerability
Modified: 8/21/2024
MEDIUM5.8Go
GHSA-65fm-2jgr-j7qq· CVE-2024-29030, GO-2024-3046memos vulnerable to Server-Side Request Forgery in /api/resource
Modified: 8/6/2024
CRITICAL9.8Go
GHSA-68gw-r2x5-7r5r· CVE-2022-4686, GO-2022-1215usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
Modified: 8/21/2024
MEDIUM5.8Go
GHSA-6fcf-g3mp-xj2x· CVE-2024-29028, GO-2024-3047memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta
Modified: 8/6/2024
MEDIUM4.3Go
GHSA-6fx9-29x2-fmfj· CVE-2022-4814, GO-2022-1251usememos/memos Improper Access Control vulnerability
Modified: 8/21/2024
HIGH8.8Go
GHSA-6w5w-wx8w-2cq9· CVE-2022-4809, GO-2022-1252usememos/memos Improper Access Control vulnerability
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-6whj-8g9g-5jvx· CVE-2022-4863, GO-2023-1270usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges
Modified: 8/20/2024
MEDIUM4.3Go
GHSA-78j5-8vq7-jxv5· CVE-2025-56760, GO-2025-3936Memos Vulnerable to Path Traversal via the CreateResource Endpoint
Modified: 9/8/2025
MEDIUM4.3Go
GHSA-7qpw-2j9m-rw8c· CVE-2022-4813, GO-2022-1253usememos/memos has Insufficient Granularity of Access Control
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-8686-4cr3-76wj· CVE-2023-0106usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM4.3Go
GHSA-8jcj-g9f4-qx42· CVE-2025-65796, GO-2025-4215memos vulnerability allows arbitrarily reactions deletion
Modified: 12/17/2025
MEDIUM5.4Go
GHSA-8p44-g572-557h· CVE-2025-65798, GO-2025-4216memos vulnerability allows arbitrarily modification or deletion of attachments
Modified: 12/17/2025
CRITICAL9.0Go
GHSA-8w5q-5fpq-v4pm· CVE-2022-4865usememos/memos Cross-site Scripting vulnerability
Modified: 11/8/2023
HIGH7.5Go
GHSA-96gq-6ch5-mm54· CVE-2023-4698usememos/memos vulnerable to improper input validation
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-97rc-mm5j-f6rj· CVE-2022-4691, GO-2022-1225usememos/memos vulnerable to stored Cross-site Scripting
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-99m2-qwx6-2w6f· CVE-2025-65797, GO-2025-4220memos vulnerability allows arbitrarily modification or deletion registered identity providers
Modified: 12/17/2025
MEDIUM6.1Go
GHSA-9cqm-mgv9-vv9j· CVE-2024-29029, GO-2024-3049memos vulnerable to Server-Side Request Forgery and Cross-site Scripting
Modified: 8/6/2024
MEDIUM5.4Go
GHSA-9h7x-9pmh-7gg8· CVE-2023-0112, GO-2023-1461usememos/memos vulnerable to stored Cross-site Scripting
Modified: 8/20/2024
MEDIUMGo
GHSA-9v48-2h5x-fvpm· CVE-2022-4685, GO-2022-1205usememos/memos vulnerable to improper access control
Modified: 8/21/2024
MEDIUM6.1Go
GHSA-9w8x-5hv5-r6gw· CVE-2022-25978, GO-2023-1566Cross Site Scripting in usememos/memos
Modified: 3/19/2025
MEDIUM5.4Go
GHSA-c2v4-8r9g-g5xj· CVE-2022-4695usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM6.5Go
GHSA-c5hq-35h7-r9x4· CVE-2022-4850usememos/memos Cross-Site Request Forgery vulnerability
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-c8jh-vcjh-fx2w· CVE-2022-4690, GO-2022-1189usememos/memos vulnerable to stored cross-site scripting (XSS)
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-cgrg-86m5-xm4w· CVE-2025-56761, GO-2025-3937Memos Vulnerable to Stored Cross-Site Scripting
Modified: 9/8/2025
MEDIUM6.5Go
GHSA-cwrm-33qq-4w2x· CVE-2022-4846usememos/memos Cross-Site Request Forgery vulnerability
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-f552-97qx-c694· CVE-2022-4692, GO-2022-1216usememos/memos vulnerable to stored Cross-site Scripting
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-f83p-pg86-p922· CVE-2022-4801, GO-2022-1235usememos/memos has Insufficient Granularity of Access Control
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-fpjc-cxr6-w6h8· CVE-2023-0108, GO-2023-1462usememos/memos vulnerable to stored Cross-site Scripting
Modified: 8/20/2024
HIGH8.1Go
GHSA-fv6c-rfg3-gvjw· CVE-2022-4687, GO-2022-1217usememos/memos makes Incorrect Use of Privileged APIs
Modified: 8/21/2024
MEDIUM4.3Go
GHSA-gfj4-wg89-m22r· CVE-2022-4807, GO-2022-1256usememos/memos Improper Access Control vulnerability
Modified: 8/21/2024
HIGH8.1Go
GHSA-ghx2-6v4g-9wmm· CVE-2022-4796, GO-2022-1236usememos/memos makes Incorrect Use of Privileged APIs
Modified: 8/21/2024
MEDIUM6.3Go
GHSA-gqp3-hfc3-8q54· CVE-2026-6634, GO-2026-5403Memos has an Incorrect Privilege Assignment issue
Modified: 7/21/2026
MEDIUM4.3Go
GHSA-gw9m-2m5v-c6x5· CVE-2022-4845, GO-2022-1257usememos/memos Cross-Site Request Forgery vulnerability
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-gxqf-4g4p-q3hc· CVE-2022-4839usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-h2ph-9r76-37v5· CVE-2023-0111, GO-2023-1465usememos/memos vulnerable to stored Cross-site Scripting
Modified: 8/20/2024
MEDIUM5.4Go
GHSA-hc5q-26h8-r9wf· CVE-2022-4811, GO-2022-1259usememos/memos Improper Authorization vulnerability
Modified: 8/21/2024
MEDIUMGo
GHSA-hfcf-79gh-f3jc· CVE-2025-50738, GO-2025-3831Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs
Modified: 8/22/2025
CRITICAL9.8Go
GHSA-j2gj-g3p9-7mrr· CVE-2023-4696, GO-2023-2038Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos
Modified: 8/21/2024
MEDIUM4.3Go
GHSA-j593-h5v3-45x6· CVE-2022-4734, GO-2022-1220usememos/memos may leak user information to an authenticated user
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-jvq8-w7qv-hqp6· CVE-2022-4799, GO-2022-1239usememos/memos Improper Authentication vulnerability
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-m5pr-wm6q-x4g2· CVE-2022-4812, GO-2022-1260usememos/memos vulnerable to Comparison of Object References Instead of Object Contents
Modified: 8/21/2024
HIGH8.8Go
GHSA-mfmp-8mqg-q4wm· CVE-2022-4803, GO-2023-1291usememos/memos Improper Access Control vulnerability
Modified: 8/20/2024
MEDIUM6.5Go
GHSA-mfvq-m3jj-8864· CVE-2022-4800, GO-2022-1240usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
Modified: 8/21/2024
HIGH7.5Go
GHSA-mg56-wc4q-rw4w· CVE-2025-65795, GO-2025-4217memos vulnerability allows the creation of arbitrary accounts
Modified: 12/17/2025
MEDIUM4.3Go
GHSA-mq5q-gpgv-pwxw· CVE-2022-4805, GO-2023-1292usememos/memos Incorrect Use of Privileged APIs vulnerability
Modified: 8/20/2024
HIGHGo
GHSA-mr34-8733-grr2· CVE-2024-21635, GO-2025-4127Memos' Access Tokens Stay Valid after User Password Change
Modified: 3/13/2026
HIGH8.1Go
GHSA-p4fx-qf2h-jpmj· CVE-2024-41659, GO-2024-3088memos CORS Misconfiguration in server.go (GHSL-2024-034)
Modified: 8/30/2024
MEDIUM5.4Go
GHSA-pcvh-px2p-vmxw· CVE-2023-0107usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM5.3Go
GHSA-pp3p-6jjh-rmg7· CVE-2022-4806, GO-2022-1261usememos/memos Improper Access Control vulnerability
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-pwhr-p68w-296x· CVE-2022-4840usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM5.3Go
GHSA-qcf5-m2c6-89f2· CVE-2022-4798, GO-2022-1243usememos/memos Improper Authorization vulnerability
Modified: 8/21/2024
MEDIUM6.5Go
GHSA-qcw2-492v-57xj· CVE-2022-4683, GO-2022-1192usememos/memos missing Secure cookie attribute
Modified: 8/21/2024
MEDIUM4.3Go
GHSA-qf9q-3wwx-8qjv· CVE-2022-4810, GO-2022-1263usememos/memos Improper Access Control vulnerability
Modified: 8/21/2024
MEDIUM4.3Go
GHSA-qgjp-5g5x-vhq2· CVE-2025-65799, GO-2025-4218memos lacks file name validation or verification
Modified: 12/17/2025
HIGH8.8Go
GHSA-qr52-59r6-49f4· CVE-2022-4684, GO-2022-1218usememos/memos Improper Access Control vulnerability
Modified: 8/21/2024
MEDIUM4.3Go
GHSA-qrrf-xvcf-p64q· CVE-2022-4797, GO-2022-1244usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-qw36-rw5q-gxcq· CVE-2022-4804, GO-2022-1245usememos/memos Improper Authorization vulnerability
Modified: 8/21/2024
HIGH8.8Go
GHSA-r3p3-5f35-h6mf· CVE-2022-4808, GO-2023-1449usememos/memos Improper Privilege Management vulnerability
Modified: 8/20/2024
MEDIUM6.5Go
GHSA-r7hg-2cpp-8wqq· CVE-2022-4847, GO-2022-1264usememos/memos has Incorrectly Specified Destination in a Communication Channel
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-rgj5-jj5q-v3v7· CVE-2022-4609Memos Cross-site Scripting vulnerability
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-rmhx-9h5h-3xh3· CVE-2022-4841usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM5.4Go
GHSA-rx2m-xr4x-54hh· CVE-2022-4802, GO-2022-1248usememos/memos vulnerable to Improper Authorization
Modified: 8/21/2024
MEDIUM5.4Go
GHSA-v92p-phmp-xffr· CVE-2022-4694usememos/memos vulnerable to stored Cross-site Scripting
Modified: 11/8/2023
MEDIUM5.7Go
GHSA-vh43-cc6x-prpr· CVE-2022-4848, GO-2022-1266usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
Modified: 8/21/2024
HIGH8.8Go
GHSA-vwg4-846x-f94v· CVE-2022-4688, GO-2022-1190usememos/memos vulnerable to improper authorization
Modified: 8/21/2024
HIGH8.8Go
GHSA-w57v-6xp4-rm2v· CVE-2022-4689, GO-2022-1191usememos/memos vulnerable to account takeover due to improper access control
Modified: 8/21/2024
MEDIUMGo
GHSA-wfxg-v3j4-7qmj· CVE-2025-22952, GO-2025-3492Memos Server-Side Request Forgery (SSRF)
Modified: 3/3/2025
MEDIUM5.4Go
GHSA-x22v-qgm2-7qc7· CVE-2023-0110, GO-2023-1469usememos/memos vulnerable to stored Cross-site Scripting
Modified: 8/20/2024
CRITICAL9.0Go
GHSA-x9p9-v3x6-68mq· CVE-2022-4866usememos/memos vulnerable to Cross-site Scripting
Modified: 11/8/2023
—Go
GO-2022-1189· CVE-2022-4690, GHSA-c8jh-vcjh-fx2wusememos/memos vulnerable to stored cross-site scripting (XSS) in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1190· CVE-2022-4688, GHSA-vwg4-846x-f94vusememos/memos vulnerable to improper authorization in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1191· CVE-2022-4689, GHSA-w57v-6xp4-rm2vusememos/memos vulnerable to account takeover due to improper access control in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1192· CVE-2022-4683, GHSA-qcw2-492v-57xjusememos/memos missing Secure cookie attribute in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1205· CVE-2022-4685, GHSA-9v48-2h5x-fvpmusememos/memos vulnerable to improper access control in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1215· CVE-2022-4686, GHSA-68gw-r2x5-7r5rusememos/memos Authorization Bypass Through User-Controlled Key vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1216· CVE-2022-4692, GHSA-f552-97qx-c694usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1217· CVE-2022-4687, GHSA-fv6c-rfg3-gvjwusememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1218· CVE-2022-4684, GHSA-qr52-59r6-49f4usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1219· CVE-2022-4767, GHSA-33m8-f4hw-wm3qusememos/memos Denial of Service vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1220· CVE-2022-4734, GHSA-j593-h5v3-45x6usememos/memos may leak user information to an authenticated user in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1225· CVE-2022-4691, GHSA-97rc-mm5j-f6rjusememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1235· CVE-2022-4801, GHSA-f83p-pg86-p922usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1236· CVE-2022-4796, GHSA-ghx2-6v4g-9wmmusememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1239· CVE-2022-4799, GHSA-jvq8-w7qv-hqp6usememos/memos Improper Authentication vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1240· CVE-2022-4800, GHSA-mfvq-m3jj-8864usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1243· CVE-2022-4798, GHSA-qcf5-m2c6-89f2usememos/memos Improper Authorization vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1244· CVE-2022-4797, GHSA-qrrf-xvcf-p64qusememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1245· CVE-2022-4804, GHSA-qw36-rw5q-gxcqusememos/memos Improper Authorization vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1248· CVE-2022-4802, GHSA-rx2m-xr4x-54hhusememos/memos vulnerable to Improper Authorization in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1250· CVE-2022-4849, GHSA-642q-2q68-9j3pusememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1251· CVE-2022-4814, GHSA-6fx9-29x2-fmfjusememos/memos Improper Access Control vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1252· CVE-2022-4809, GHSA-6w5w-wx8w-2cq9usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1253· CVE-2022-4813, GHSA-7qpw-2j9m-rw8cusememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
Modified: 3/3/2026
—Go
GO-2022-1256· CVE-2022-4807, GHSA-gfj4-wg89-m22rusememos/memos Improper Access Control vulnerability in github.com/usememos/memos
Modified: 3/3/2026