QuantumNous new-api vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202616

Newest CVEs

• CVE-2026-82909

  QuantumNous new-api Revoked API Token token session expiration

  QuantumNous · new-api

  Medium5.3
• CVE-2026-64865

  New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

  QuantumNous · new-api

  Medium6.0
• CVE-2026-71479

  New API: Integer overflow in quota billing yields negative charges (self-crediting)

  QuantumNous · new-api

  Critical9.1
• CVE-2026-64866

  New API: Admin can reset passkeys for same-level or higher-privileged users

  QuantumNous · new-api

  Medium5.1
• CVE-2026-64868

  New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

  QuantumNous · new-api

  High7.5
• CVE-2026-64859

  New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

  QuantumNous · new-api

  Critical9.1
• CVE-2026-44342

  New API CSRF in email and WeChat account binding endpoints

  QuantumNous · new-api

  Medium5.3
• CVE-2026-33655

  New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

  QuantumNous · new-api

  High7.7
• CVE-2026-9306

  QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

  QuantumNous · new-api

  Medium6.3
• CVE-2026-9305

  QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection

  QuantumNous · new-api

  Medium5.3