Skip to content
OpenAdvisories

Package · Go

github.com/QuantumNous/new-api

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-64868

    New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature val…

    QuantumNous new-api github.com/QuantumNous/new-api Go
  • High 7.7
    CVE-2026-33655

    New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by defaul…

    QuantumNous new-api github.com/QuantumNous/new-api Go
  • High 7.1
    CVE-2026-42339

    New API: SSRF Filter Bypass via 0.0.0.0

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block t…

    QuantumNous new-api github.com/QuantumNous/new-api Go
  • High 7.1
    CVE-2026-41432

    New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit …

    QuantumNous new-api github.com/QuantumNous/new-api Go
  • High 7.6
    CVE-2026-25802

    New API has Potential XSS in its MarkdownRenderer component

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the …

    QuantumNous new-api github.com/QuantumNous/new-api Go
  • High 7.1
    CVE-2026-25591

    New API has an SQL LIKE Wildcard Injection DoS via Token Search

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the `/api/token/search` endpoint allows authenticated users to cause deni…

    QuantumNous new-api github.com/QuantumNous/new-api Go
  • High 8.5
    CVE-2025-62155

    QuantumNous New API Has SSRF Bypass

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to o…

    QuantumNous new-api github.com/QuantumNous/new-api Go