Quantumnous New-Api
18 CVEs affecting Quantumnous New-Api. Latest disclosed: 2026-08-31. Critical: 2, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71479 | Critical | 9.1 | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video s… |
CVE-2026-64859 | Critical | 9.1 | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user look… |
CVE-2025-62155 | High | 8.5 | 2025-11-25 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulner… |
CVE-2025-59146 | High | 8.5 | 2025-10-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side Request Forgery (SSRF) vu… |
CVE-2026-33655 | High | 7.7 | 2026-07-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection c… |
CVE-2026-25802 | High | 7.6 | 2026-02-24 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe op… |
CVE-2026-64868 | High | 7.5 | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /… |
CVE-2026-42339 | High | 7.1 | 2026-05-08 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protect… |
CVE-2026-41432 | High | 7.1 | 2026-05-08 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in th… |
CVE-2026-30886 | Medium | 6.5 | 2026-03-23 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Ob… |
CVE-2026-25591 | Medium | 6.5 | 2026-02-24 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard… |
CVE-2026-9305 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/top… |
CVE-2026-44342 | Medium | 5.3 | 2026-07-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account… |
CVE-2026-32879 | Medium | 4.9 | 2026-03-23 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Starting in version 0.10.0, a logic flaw in the univer… |
CVE-2026-82909 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of… |
CVE-2026-9306 | Low | 3.7 | 2026-05-23 | A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router… |
CVE-2026-64866 | | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in co… | |
CVE-2026-64865 | | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requ… |