QuantumNous vulnerabilities
We track 8 vulnerabilities in QuantumNous products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.
Latest QuantumNous vulnerabilities
- 9.1 Critical severity
new-api: Integer Overflow or Wraparound
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-
- 7.5 High severity
new-api: Uncontrolled Resource Consumption
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature vali
- 9.1 Critical severity
new-api: Exposure of Sensitive Information to an Unauthorized Actor
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects
- 7.7 High severity
new-api: Server-Side Request Forgery
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default
- 7.1 High severity
new-api: Server-Side Request Forgery
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block th
- 8.2 High severity
new-api: Insufficient Verification of Data Authenticity
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit a
- 8.5 High severity
new-api: Server-Side Request Forgery
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to oc
- 8.5 High severity
new-api: Server-Side Request Forgery
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in versions prior to 0.9.0.5. A feature within the application allows authenticate