QuantumNous new-api

• CVE-2026-82909 Medium 4.3 QuantumNous new-api Revoked API Token token session expiration 0.4%
• CVE-2026-64865 Medium 6.0 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass 0.3%
• CVE-2026-71479 Critical 9.1 New API: Integer overflow in quota billing yields negative charges (self-crediting) 0.6%
• CVE-2026-64866 Medium 5.1 New API: Admin can reset passkeys for same-level or higher-privileged users 0.5%
• CVE-2026-64868 High 7.5 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging 0.6%
• CVE-2026-64859 Critical 9.1 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation 0.6%
• CVE-2026-44342 Medium 5.3 New API CSRF in email and WeChat account binding endpoints 0.2%
• CVE-2026-33655 High 7.7 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs 0.4%
• CVE-2026-9306 Low 3.7 QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization 0.3%
• CVE-2026-9305 Medium 6.3 QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection 0.2%
• CVE-2026-42339 High 7.1 New API: SSRF Filter Bypass via 0.0.0.0 0.3%
• CVE-2026-41432 High 7.1 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud 0.9%
• CVE-2026-32879 Medium 4.9 New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure 0.3%
• CVE-2026-30886 Medium 6.5 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check 0.3%
• CVE-2026-25802 High 7.6 New API has Potential XSS in its MarkdownRenderer component 0.3%
• CVE-2026-25591 High 7.1 New API has an SQL LIKE Wildcard Injection DoS via Token Search 0.6%
• CVE-2025-62155 High 8.5 QuantumNous New API Has SSRF Bypass 0.3%
• CVE-2025-59146 High 8.5 New API has Authenticated Server-Side Request Forgery (SSRF) issue 0.2%