Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

QuantumNous — Vulnerabilities & Security Advisories 18

Browse all 18 CVE security advisories affecting QuantumNous. AI-powered Chinese analysis, POCs, and references for each vulnerability.

QuantumNous develops AI-powered security analytics platforms for threat detection and vulnerability management. Historically, their products have been susceptible to remote code execution, cross-site scripting, and privilege escalation vulnerabilities, with six CVEs documented to date. The platform's complex integrations with third-party APIs have introduced additional attack surfaces. While no major public security incidents have been reported, the consistent pattern of authentication bypass flaws in earlier versions suggests implementation challenges in access control mechanisms. Recent releases show improved input validation, though legacy deployments may remain exposed to known exploit chains.

Found 18 results / 18 Clear Filters
Top products by QuantumNous: new-api
CVE ID Title CVSS Severity Published
CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration — new-api CWE-613 4.3 Medium 2026-08-31
CVE-2026-64865 New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass — new-api CWE-362 6.0 Medium 2026-08-17
CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting) — new-api CWE-190 9.1 Critical 2026-08-17
CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users — new-api CWE-862 5.1 Medium 2026-08-17
CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging — new-api CWE-400 7.5 High 2026-08-17
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation — new-api CWE-200 9.1 Critical 2026-08-17
CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints — new-api CWE-352 5.3 Medium 2026-07-09
CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs — new-api CWE-918 7.7 High 2026-07-09
CVE-2026-9306 QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization — new-api CWE-639 3.7 Low 2026-05-23
CVE-2026-9305 QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection — new-api CWE-89 6.3 Medium 2026-05-23
CVE-2026-42339 New API: SSRF Filter Bypass via 0.0.0.0 — new-api CWE-918 8.1AI High AI 2026-05-08
CVE-2026-41432 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud — new-api CWE-345 7.1 High 2026-05-08
CVE-2026-32879 New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure — new-api CWE-287 4.9 Medium 2026-03-23
CVE-2026-30886 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check — new-api CWE-639 6.5 Medium 2026-03-23
CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component — new-api CWE-79 7.6 High 2026-02-24
CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search — new-api CWE-943 6.5AI Medium AI 2026-02-24
CVE-2025-62155 QuantumNous New API Has SSRF Bypass — new-api CWE-918 8.5 High 2025-11-24
CVE-2025-59146 New API has Authenticated Server-Side Request Forgery (SSRF) issue — new-api CWE-918 8.5 High 2025-10-09

This page lists every published CVE security advisory associated with QuantumNous. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.