CVE-2023-4696

CVE-2023-4696 Account Takeover Due to Improper Handling of JWT Tokens in memos v0.13.2 Description I want to shed light on a significant security vulnerability I recently discovered within the usememos/memos system. This vulnerability has the potential to allow any user to modify another user’s...

Memos 0.13.2 - Server-Side Request Forgery

SSRF vulnerabilities exist in the memos API service /o/get/httpmeta that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the...

Elestio Memos <= v0.24.0 - Server-Side Request Forgery

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. id: CVE-2025-22952 info: name: Elestio Memos = v0.24.0 - Server-Side Request Forgery author: iamnoooob,rootxharsh,pdresearc...

CVE-2023-4698

CVE-2023-4698 Local File Inclusion LFI in usememos/memos 0.13.2 Description Today, I want to shine a spotlight on a significant discovery — a critical security vulnerability that has been identified in usememos/memos. This vulnerability, which falls under the category of Local File Inclusion LFI,...

CVE-2026-113601

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601

Versions of Memos prior to 0.27.0 are vulnerable to a missing authorization flaw in the ActivityService ListActivities and GetActivity API methods. This vulnerability allows authenticated users to view activity records from all other users by enumerating sequential activity IDs. Impacted data inc...

EUVD-2026-105167

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

PT-2026-118461

Name of the Vulnerable Software and Affected Versions Memos versions prior to 0.27.0 Description Authenticated users can view activity records of all users due to missing authorization in the ActivityService ListActivities and GetActivity API endpoints. Low-privileged attackers can enumerate...

Memo authorization issue vulnerabilities

Versions of Memos prior to 0.27.0 have a vulnerability related to authorization. This vulnerability stems from the lack of authorization checks in the ActivityService’s ListActivities and GetActivity API methods. Low-privilege attackers can enumerate consecutive activity IDs, obtain the creator I...

MemoryOS 2.0.34 was published with a credential-stealing binary

An attacker with write access to the GitHub repository pushed maliciouscommits and tagged v2.0.34, and the project's own GitHub Actions releaseworkflow built and uploaded 2.0.34 to PyPI.Importing the package runs memos/stage0.py, which launchesa bundled sckit binary that collects...

PYSEC-2026-3987 MemoryOS 2.0.34 was published with a credential-stealing binary

An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project's own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/stage0.py, which launches a bundled sckit binary that collects credentials...

Malware in @memtensor/memos-cloud-openclaw-plugin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MSC-2026-11646

Two packages from the MemTensor ecosystem were compromised and republished with malicious code: npm @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25, and PyPI MemoryOS 2.0.34. The malicious versions ship prebuilt native binaries for Windows, Linux and macOS that the packa...

Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...