What’s Vulnerable › Products

QuantumNous new-api vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your QuantumNous new-api version is affected

Latest QuantumNous new-api vulnerabilities

• CVE-2026-82909 — QuantumNous new-api Revoked API Token token session expiration (CVSS 4.3)
• CVE-2026-71479 — New API: Integer overflow in quota billing yields negative charges (self-crediting) (CVSS 9.1)
• CVE-2026-64868 — New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging (CVSS 7.5)
• CVE-2026-64866 — New API: Admin can reset passkeys for same-level or higher-privileged users (CVSS 5.1)
• CVE-2026-64865 — New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass (CVSS 6.0)
• CVE-2026-64859 — New API: User List API Leaks Root User Access Token Leading to Privilege Escalation (CVSS 9.1)
• CVE-2026-44342 — New API CSRF in email and WeChat account binding endpoints (CVSS 5.3)
• CVE-2026-33655 — New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs (CVSS 7.7)
• CVE-2026-9306 — QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization (CVSS 3.7)
• CVE-2026-9305 — QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection (CVSS 6.3)
• CVE-2026-42339 — New API: SSRF Filter Bypass via 0.0.0.0 (CVSS 7.1)
• CVE-2026-41432 — New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud (CVSS 8.2)
• CVE-2026-32879 — New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure (CVSS 4.9)
• CVE-2026-30886 — New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check (CVSS 6.5)
• CVE-2026-25802 — New API has Potential XSS in its MarkdownRenderer component (CVSS 5.4)
• CVE-2026-25591 — New API has an SQL LIKE Wildcard Injection DoS via Token Search (CVSS 6.5)
• CVE-2025-62155 — QuantumNous New API Has SSRF Bypass (CVSS 8.5)
• CVE-2025-59146 — New API has Authenticated Server-Side Request Forgery (SSRF) issue (CVSS 8.5)
• CVE-2025-55573 — (CVSS 8.8)