Lucene search
+L

80 matches found

OSV
OSV
added 2 days ago2 views

CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...

5.1CVSS5.5AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-64866

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...

5.1CVSS5.3AI score0.00363EPSS
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 2 days ago33 views

CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...

5.1CVSS0.00363EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago25 views

CVE-2026-64868

New API (github.com/QuantumNous/new-api) versions before v1.0.0-rc.11 read and log full request bodies on unauthenticated payment webhook endpoints (Stripe, Creem, Waffo) before signature validation. An unauthenticated remote attacker can send oversized payloads to cause memory pressure, containe...

7.5CVSS5.4AI score0.00467EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2 days ago6 views

CVE-2026-64868

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

7.5CVSS5.3AI score0.00467EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2 days ago3 views

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

7.5CVSS5.5AI score
SaveExploits0References6
Vulnrichment
Vulnrichment
added 2 days ago8 views

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

7.5CVSS5.3AI score0.00467EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2 days ago34 views

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

7.5CVSS0.00467EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2 days ago6 views

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

9.1CVSS5.3AI score0.00464EPSS
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 2 days ago33 views

CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

9.1CVSS0.00464EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago28 views

CVE-2026-64859

In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...

9.1CVSS5.4AI score0.00464EPSS
SaveExploits0References4
OSV
OSV
added 2 days ago8 views

CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

9.1CVSS5.5AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2 days ago7 views

PT-2026-76685

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

7.5CVSS5.3AI score0.00467EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2 days ago7 views

PT-2026-76689

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs ...

6CVSS5.2AI score0.00243EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2 days ago7 views

PT-2026-76690

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset passkey, allowing a lower-privileged...

5.1CVSS5.3AI score0.00363EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2 days ago10 views

PT-2026-76684

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access token because User model objects are serialized after queries use...

9.1CVSS5.3AI score0.00464EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2 days ago11 views

PT-2026-76692

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.18 Description An issue exists where user-controlled quantity parameters can cause overflow conversions during quota calculations in common/quota math.go and related settlement paths. A low-privileged account...

9.1CVSS5.2AI score0.00519EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/17 7:42 p.m.16 views

GO-2026-5929 New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api

New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api...

5.3CVSS5.3AI score0.00159EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/09 11:17 p.m.16 views

CVE-2026-44342

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...

5.3CVSS0.00159EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/06/25 11:23 p.m.15 views

CVE-2026-52945

A flaw was found in the Linux kernel's WireGuard component. Under heavy network load, particularly when used with Cilium, the threaded NAPI New API implementation can cause the decryption side for a WireGuard peer to stop processing traffic. This leads to a complete stall of network communication...

7.5CVSS5.8AI score0.00309EPSS
SaveExploits0References3
Rows per page
Query Builder