github.com/quantumnous/new-api
Open-source AI gateway. Self-hosted LLM gateway with OpenAI-, Claude- and Gemini-compatible APIs, model routing, access control, usage tracking and cost accounting.
View on Github
Activity
- Latest release
- 4d ago
- Total releases
- 90
- Cadence
- ~2 days
- Last 12 months
- 72
Reach
- Stars
- 50.9k
Details
- First release
- Dec 11, 2023
| Version | Released | |
|---|---|---|
v1.0.0-rc.47
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.47
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.46
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.46
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.45
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.45
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.44
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.44
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.43
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.43
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.42
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.42
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.41
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.41
pre
Dependencies (73)
+ 65 more |
|
v1.0.0-rc.40
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.40
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.39
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.39
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.38
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.38
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.37
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.37
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.36
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.36
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.35
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.35
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.34
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.34
pre
Dependencies (70)
+ 62 more |
|
v1.0.0-rc.33
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.33
pre
Dependencies (68)
+ 60 more |
|
v1.0.0-rc.32
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.32
pre
Dependencies (68)
+ 60 more |
|
v1.0.0-rc.31
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.31
pre
Dependencies (68)
+ 60 more |
|
v1.0.0-rc.30
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.30
pre
Dependencies (68)
+ 60 more |
|
v1.0.0-rc.29
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.29
pre
Dependencies (68)
+ 60 more |
|
v1.0.0-rc.28
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.28
pre
Dependencies (67)
+ 59 more |
|
v1.0.0-rc.27
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.27
pre
Dependencies (67)
+ 59 more |
|
v1.0.0-rc.26
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.26
pre
Dependencies (65)
+ 57 more |
|
v1.0.0-rc.25
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.25
pre
Dependencies (65)
+ 57 more |
|
v1.0.0-rc.24
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.24
pre
Dependencies (65)
+ 57 more |
|
v1.0.0-rc.23
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.23
pre
Dependencies (65)
+ 57 more |
|
v1.0.0-rc.22
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.22
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.21
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.21
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.20
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.20
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.19-i18nfix.2
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.19-i18nfix.2
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.19-i18nfix.1
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.19-i18nfix.1
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.19
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.19
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.18
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.18
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.17
pre
6 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.17
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.16
pre
6 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.16
pre
Dependencies (59)
+ 51 more |
|
v1.0.0-rc.15
pre
7 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.15
pre
Dependencies (58)
+ 50 more |
|
v1.0.0-rc.14
pre
7 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.14
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.13
pre
7 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.13
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.12
pre
7 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.12
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.11
pre
7 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.11
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.10
pre
8 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64868
GO-2026-6245
GHSA-v828-m3pf-vq9q
Aug 18, 2026
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.11
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.10
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.9
pre
3 CVEs
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.9
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.8
pre
3 CVEs
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.8
pre
Dependencies (56)
+ 48 more |
|
v1.0.0-rc.7
pre
3 CVEs
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.7
pre
Dependencies (55)
+ 47 more |
|
v1.0.0-rc.6
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.6
pre
Dependencies (55)
+ 47 more |
|
v1.0.0-rc.4
pre
5 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v1.0.0-rc.4
pre
Dependencies (55)
+ 47 more |
|
v0.13.0
minor
8 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64868
GO-2026-6245
GHSA-v828-m3pf-vq9q
Aug 18, 2026
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.11
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v0.13.0
minor
Dependencies (55)
+ 47 more |
|
v0.12.15
patch
8 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64868
GO-2026-6245
GHSA-v828-m3pf-vq9q
Aug 18, 2026
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.11
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v0.12.15
patch
Dependencies (54)
+ 46 more |
|
v0.12.13
patch
8 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64868
GO-2026-6245
GHSA-v828-m3pf-vq9q
Aug 18, 2026
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.11
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v0.12.13
patch
Dependencies (54)
+ 46 more |
|
v0.12.12
patch
8 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64868
GO-2026-6245
GHSA-v828-m3pf-vq9q
Aug 18, 2026
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.11
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v0.12.12
patch
Dependencies (54)
+ 46 more |
|
v0.12.9
patch
9 CVEs
CVE-2026-64866
GO-2026-6244
GHSA-p845-629j-rcj6
Aug 18, 2026
New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: . Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64865
GO-2026-6243
GHSA-j6gc-4893-qwmp
Aug 18, 2026
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.16
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-71479
GO-2026-6242
GHSA-8r8v-xf7q-rcpr
Aug 18, 2026
New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.18
References
Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64859
GO-2026-6240
GHSA-6x2c-phff-wx57
Aug 18, 2026
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.7
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-64868
GO-2026-6245
GHSA-v828-m3pf-vq9q
Aug 18, 2026
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api Fixed in
1.0.0-rc.11
References Updated Aug 18, 2026 · Source: OSV.dev
CVE-2026-41432
GO-2026-5753
GHSA-xff3-5c9p-2mr4
Jun 25, 2026
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api Fixed in
0.12.10
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42339
GO-2026-5652
GHSA-v5c3-6wvc-pc2q
Jun 25, 2026
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-32879
GO-2026-4813
GHSA-5353-f8fq-65vc
Mar 26, 2026
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api Updated Mar 26, 2026 · Source: OSV.dev
CVE-2025-62155
GO-2025-4154
GHSA-9f46-w24h-69w4
Dec 15, 2025
new-api is vulnerable to SSRF Bypass in one-api new-api is vulnerable to SSRF Bypass in one-api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/QuantumNous/new-api before v0.9.6. References Updated Dec 15, 2025 · Source: OSV.dev |
v0.12.9
patch
Dependencies (54)
+ 46 more |