PT-2026-77785

Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

GHSA-8R8V-XF7Q-RCPR New API: Integer overflow in quota billing yields negative charges (self-crediting)

Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...

New API: Integer overflow in quota billing yields negative charges (self-crediting)

Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...

CVE-2026-71479

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-64865

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-64865

New API (an LLM gateway and AI asset management system) prior to v1.0.0-rc.16 is affected by a race condition in the PUT /api/user/self endpoint. When an authenticated user repeatedly updates language or sidebar_modules, the settings path writes a stale full user snapshot via RedisHSetObj to the ...

CVE-2026-64865

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-64865 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...

CVE-2026-71479

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

EUVD-2026-60262

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-71479

In New API (github.com/QuantumNous/new-api) before 1.0.0-rc.18, user-controlled billing multipliers (n, duration, max_tokens, etc.) lacked upper-bound validation and overflow-safe conversion in common/quota_math.go, causing integer overflow into negative settlement charges that credit attacker ac...

PT-2026-76689

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs ...

PT-2026-76692

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.18 Description An issue exists where user-controlled quantity parameters can cause overflow conversions during quota calculations in common/quota math.go and related settlement paths. A low-privileged account...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087

The CVE describes an authorization bypass in the WP Travel Engine – Tour Booking Plugin (Tour Operator Software) for WordPress, up to version 6.8.4. An unauthenticated attacker can view private booking billing details (customer name, email, address, phone) by binding an arbitrary booking_id to th...

EUVD-2026-59926

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...