QuantumNous

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

QuantumNous records in CISA KEV

No QuantumNous vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

New Api 9 records HIGH

Records

19 records

TI-2025-35042 CVE-2025-55573 · GHSA-8mvm-xhp4-8qjp

QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).

HIGH 73

QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00421 Published 2025-08-22 No fix listed CWE-79

TI-2026-30643 CVE-2026-42339 · GHSA-v5c3-6wvc-pc2q

New API: SSRF Filter Bypass via 0.0.0.0

HIGH 70

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-05-08 No fix listed CWE-918

TI-2026-30031 CVE-2026-41432 · GHSA-xff3-5c9p-2mr4

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

HIGH 69

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0085 Published 2026-05-08 Fixed in 0.12.10 CWE-1188

TI-2026-20865 CVE-2026-25802 · GHSA-299v-8pq9-5gjq

New API has Potential XSS in its MarkdownRenderer component

HIGH 66

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00256 Published 2026-02-24 Fixed in 0.10.8-alpha.9 CWE-79

TI-2026-20698 CVE-2026-25591 · GHSA-w6x6-9fp7-fqm4

New API has an SQL LIKE Wildcard Injection DoS via Token Search

MEDIUM 64

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00567 Published 2026-02-24 Fixed in 0.10.8-alpha.10 CWE-943

TI-2026-23715 CVE-2026-30886 · GHSA-f35r-v9x5-r8mc

New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

MEDIUM 62

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00279 Published 2026-03-23 Fixed in 0.11.4-alpha.2 CWE-639

TI-2026-08172 CVE-2026-9306 · GHSA-cgrh-9fc9-55f9

QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

MEDIUM 61

A security vulnerability has been detected in QuantumNous new-api up to 0.12.1.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00291 Published 2026-05-23 No fix listed CWE-285

TI-2026-57199 CVE-2026-82909 · GHSA-76j5-99cp-jhpp

QuantumNous new-api Revoked API Token token session expiration

MEDIUM 57

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-31 Fixed in 1.0.0-rc.17 CWE-613

TI-2026-08171 CVE-2026-9305 · GHSA-hqv7-8cjm-q98x

QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection

MEDIUM 57

A weakness has been identified in QuantumNous new-api up to 0.12.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00192 Published 2026-05-23 No fix listed CWE-74

TI-2026-50094 CVE-2026-71479 · GHSA-8r8v-xf7q-rcpr

New API: Integer overflow in quota billing yields negative charges (self-crediting)

MEDIUM 46

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00647 Published 2026-08-17 Fixed in 1.0.0-rc.18 CWE-190

TI-2026-46371 CVE-2026-64859 · GHSA-6x2c-phff-wx57

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

MEDIUM 42

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00626 Published 2026-08-17 Fixed in 1.0.0-rc.7 CWE-200

TI-2026-46375 CVE-2026-64868 · GHSA-v828-m3pf-vq9q

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

MEDIUM 40

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00639 Published 2026-08-17 Fixed in 1.0.0-rc.11 CWE-400

TI-2025-38477 CVE-2025-62155 · GHSA-9f46-w24h-69w4

QuantumNous New API Has SSRF Bypass

LOW 37

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00299 Published 2025-11-24 Fixed in 0.9.6 CWE-918

TI-2025-36751 CVE-2025-59146

New API has Authenticated Server-Side Request Forgery (SSRF) issue

LOW 36

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00245 Published 2025-10-09 Fixed in 0.9.0.5 CWE-918

TI-2026-26035 CVE-2026-33655 · GHSA-6qcr-qxgr-m7fv

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

LOW 34

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-09 Fixed in 0.12.0-alpha.1 CWE-918

TI-2026-46373 CVE-2026-64865 · GHSA-j6gc-4893-qwmp

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

LOW 27

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00295 Published 2026-08-17 Fixed in 1.0.0-rc.16 CWE-362

TI-2026-46374 CVE-2026-64866 · GHSA-p845-629j-rcj6

New API: Admin can reset passkeys for same-level or higher-privileged users

LOW 24

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00473 Published 2026-08-17 Fixed in 1.0.0-rc.7 CWE-862

TI-2026-32309 CVE-2026-44342 · GHSA-26v7-h57m-gh9m

New API CSRF in email and WeChat account binding endpoints

LOW 23

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00191 Published 2026-07-09 Fixed in 0.12.0-alpha.1 CWE-352

TI-2026-25338 CVE-2026-32879 · GHSA-5353-f8fq-65vc

New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

LOW 22

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00295 Published 2026-03-23 No fix listed CWE-287

Open these records in search →

Critical	2
High	9
Medium	8
Low	0
No CVSS	0