Vulnerabilities

TI-2026-57199 CVE-2026-82909 · GHSA-76j5-99cp-jhpp

QuantumNous new-api Revoked API Token token session expiration

MEDIUM 57

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-31 Fixed in 1.0.0-rc.17 CWE-613

TI-2026-46373 CVE-2026-64865 · GHSA-j6gc-4893-qwmp

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

LOW 27

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00295 Published 2026-08-17 Fixed in 1.0.0-rc.16 CWE-362

TI-2026-50094 CVE-2026-71479 · GHSA-8r8v-xf7q-rcpr

New API: Integer overflow in quota billing yields negative charges (self-crediting)

MEDIUM 46

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00647 Published 2026-08-17 Fixed in 1.0.0-rc.18 CWE-190

TI-2026-46374 CVE-2026-64866 · GHSA-p845-629j-rcj6

New API: Admin can reset passkeys for same-level or higher-privileged users

LOW 24

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00473 Published 2026-08-17 Fixed in 1.0.0-rc.7 CWE-862

TI-2026-46375 CVE-2026-64868 · GHSA-v828-m3pf-vq9q

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

MEDIUM 40

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00639 Published 2026-08-17 Fixed in 1.0.0-rc.11 CWE-400

TI-2026-46371 CVE-2026-64859 · GHSA-6x2c-phff-wx57

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

MEDIUM 42

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00626 Published 2026-08-17 Fixed in 1.0.0-rc.7 CWE-200

TI-2026-32309 CVE-2026-44342 · GHSA-26v7-h57m-gh9m

New API CSRF in email and WeChat account binding endpoints

LOW 23

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00191 Published 2026-07-09 Fixed in 0.12.0-alpha.1 CWE-352

TI-2026-26035 CVE-2026-33655 · GHSA-6qcr-qxgr-m7fv

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

LOW 34

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-09 Fixed in 0.12.0-alpha.1 CWE-918

TI-2026-08172 CVE-2026-9306 · GHSA-cgrh-9fc9-55f9

QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

MEDIUM 61

A security vulnerability has been detected in QuantumNous new-api up to 0.12.1.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00291 Published 2026-05-23 No fix listed CWE-285

TI-2026-08171 CVE-2026-9305 · GHSA-hqv7-8cjm-q98x

QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection

MEDIUM 57

A weakness has been identified in QuantumNous new-api up to 0.12.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00192 Published 2026-05-23 No fix listed CWE-74

TI-2026-30643 CVE-2026-42339 · GHSA-v5c3-6wvc-pc2q

New API: SSRF Filter Bypass via 0.0.0.0

HIGH 70

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-05-08 No fix listed CWE-918

TI-2026-30031 CVE-2026-41432 · GHSA-xff3-5c9p-2mr4

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

HIGH 69

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0085 Published 2026-05-08 Fixed in 0.12.10 CWE-1188

TI-2026-25338 CVE-2026-32879 · GHSA-5353-f8fq-65vc

New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure

LOW 22

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00295 Published 2026-03-23 No fix listed CWE-287

TI-2026-23715 CVE-2026-30886 · GHSA-f35r-v9x5-r8mc

New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

MEDIUM 62

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00279 Published 2026-03-23 Fixed in 0.11.4-alpha.2 CWE-639

TI-2026-20865 CVE-2026-25802 · GHSA-299v-8pq9-5gjq

New API has Potential XSS in its MarkdownRenderer component

HIGH 66

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00256 Published 2026-02-24 Fixed in 0.10.8-alpha.9 CWE-79

TI-2026-20698 CVE-2026-25591 · GHSA-w6x6-9fp7-fqm4

New API has an SQL LIKE Wildcard Injection DoS via Token Search

MEDIUM 64

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00567 Published 2026-02-24 Fixed in 0.10.8-alpha.10 CWE-943

TI-2025-38477 CVE-2025-62155 · GHSA-9f46-w24h-69w4

QuantumNous New API Has SSRF Bypass

LOW 37

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00299 Published 2025-11-24 Fixed in 0.9.6 CWE-918

TI-2025-36751 CVE-2025-59146

New API has Authenticated Server-Side Request Forgery (SSRF) issue

LOW 36

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00245 Published 2025-10-09 Fixed in 0.9.0.5 CWE-918

TI-2025-35042 CVE-2025-55573 · GHSA-8mvm-xhp4-8qjp

QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).

HIGH 73

QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00421 Published 2025-08-22 No fix listed CWE-79

Vulnerabilities

Filters