38 matches found
PT-2026-42886
Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2 Description An issue in the Midjourney Image Relay Endpoint component, specifically within the RelayMidjourneyImage/GetByOnlyMJId function located in the router/relay-router.go file, allows for a...
PT-2026-42885
Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2 Description A SQL injection flaw exists in the 'self' Endpoint within the model/topup.go file. The issue is located in the SearchUserTopUps and SearchAllTopUps functions, allowing a remote attacker ...
New API 数据伪造问题漏洞
The New API is an interface software developed by QuantumNous. Versions of the New API prior to 0.12.10 had a data manipulation vulnerability. This vulnerability stems from defects in the Stripe webhook handler, which could allow unauthorized attackers to forge webhook events and arbitrarily...
CVE-2026-42339
creationtimestamp| type| source ---|---|--- 2026-05-06 12:19:03+00:00| published-proof-of-concept| https://github.com/QuantumNous/new-api/security/advisories/GHSA-v5c3-6wvc-pc2q...
GO-2026-4813 New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api...
New API 授权问题漏洞
The New API is an interface software developed by QuantumNous. Versions of the New API starting from 0.10.0 have a vulnerability related to authorization. This vulnerability stems from logical flaws in the general security verification process, allowing authenticated users with registered...
New API 代码问题漏洞
New API is a QuantumNous open source interface software. A code issue vulnerability exists in versions of New API prior to 0.9.6 that stems from an incomplete SSRF fix and a 302 redirect to bypass security restrictions...
CVE-2025-62155 QuantumNous New API Has SSRF Bypass
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur. Because the existing fix only applie...
CVE-2025-62155
The CVE-2025-62155 entry concerns QuantumNous/new-api. A SSRF vulnerability existed prior to version 0.9.6 where the fix only protected the first URL request; an attacker could bypass via a 302 redirect and reach internal/intranet resources. The issue has been addressed in version 0.9.6, accordin...
EUVD-2025-25523
Malicious code in bioql PyPI...
CVE-2025-55573
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting XSS...
CVE-2025-55573
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting XSS...
CVE-2025-55573
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting XSS...
New API 安全漏洞
New API is a QuantumNous open source interface software. A security vulnerability exists in New API version 0.8.5.2 that stems from vulnerability to cross-site scripting attacks...
PT-2025-34369 · Quantumnous · Quantumnous New-Api
Name of the Vulnerable Software and Affected Versions: QuantumNous new-api version 0.8.5.2 Description: The QuantumNous new-api is susceptible to a Cross-Site Scripting XSS issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...
CVE-2025-55573
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting XSS...
CVE-2025-55573
CVE-2025-55573 affects QuantumNous new-api v0.8.5.2. The vulnerability is Cross-Site Scripting (XSS). CVSSv3.1 base score 8.8 (HIGH) with NETWORK attack vector, LOW complexity, no privileges, user interaction required; impact on confidentiality, integrity, and availability all HIGH. Public techni...