QuantumNous

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

QuantumNous records in CISA KEV

No QuantumNous vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

New Api 9 records HIGH

Records

9 records in New Api · all components

TI-2025-35042 CVE-2025-55573 · GHSA-8mvm-xhp4-8qjp

QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).

HIGH 73

QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00421 Published 2025-08-22 No fix listed CWE-79

TI-2026-30643 CVE-2026-42339 · GHSA-v5c3-6wvc-pc2q

New API: SSRF Filter Bypass via 0.0.0.0

HIGH 70

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-05-08 No fix listed CWE-918

TI-2026-30031 CVE-2026-41432 · GHSA-xff3-5c9p-2mr4

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

HIGH 69

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0085 Published 2026-05-08 Fixed in 0.12.10 CWE-1188

TI-2026-20865 CVE-2026-25802 · GHSA-299v-8pq9-5gjq

New API has Potential XSS in its MarkdownRenderer component

HIGH 66

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00256 Published 2026-02-24 Fixed in 0.10.8-alpha.9 CWE-79

TI-2026-20698 CVE-2026-25591 · GHSA-w6x6-9fp7-fqm4

New API has an SQL LIKE Wildcard Injection DoS via Token Search

MEDIUM 64

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00567 Published 2026-02-24 Fixed in 0.10.8-alpha.10 CWE-943

TI-2026-23715 CVE-2026-30886 · GHSA-f35r-v9x5-r8mc

New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

MEDIUM 62

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00279 Published 2026-03-23 Fixed in 0.11.4-alpha.2 CWE-639

TI-2026-26035 CVE-2026-33655 · GHSA-6qcr-qxgr-m7fv

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

LOW 34

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-09 Fixed in 0.12.0-alpha.1 CWE-918

TI-2026-32309 CVE-2026-44342 · GHSA-26v7-h57m-gh9m

New API CSRF in email and WeChat account binding endpoints

LOW 23

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00191 Published 2026-07-09 Fixed in 0.12.0-alpha.1 CWE-352

TI-2026-25338 CVE-2026-32879 · GHSA-5353-f8fq-65vc

New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

LOW 22

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00295 Published 2026-03-23 No fix listed CWE-287

Open these records in search →