Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-56761
5.4
MEDIUMCVSS v3
Published
September 3, 2025
Affected
4 projects
Assigned by
MITRE
Severity scale
010
Description
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.
usememos/memos
GitHubOpen-source, self-hosted note-taking tool built for quick capture. Markdown-native, lightweight, and fully yours.
GitHubOpen-source, self-hosted note-taking tool built for quick capture. Markdown-native, lightweight, and fully yours.= 0.22.0NVD
neosmemo/memos
Docker HubA privacy-first, lightweight note-taking service. Easily capture and share your great thoughts.
Docker HubA privacy-first, lightweight note-taking service. Easily capture and share your great thoughts.= 0.22.0NVD
NPM