{"schema_version":1,"title":"QuantumNous New API vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in QuantumNous New API: 0 in the last 7 days and 8 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-82909, was published on 31 August 2026.","url":"https://junglewise.ai/threats/technologies/new-api","json_url":"https://junglewise.ai/threats/technologies/new-api.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/new-api","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":12,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":8,"last_365_days":12},"latest":[{"cve":"CVE-2026-82909","cvss":4.3,"epss":0.0039,"slug":"cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token","title":"QuantumNous new-api session expiration in Revoked API Token Handler","severity":"medium","exploited":false,"published_at":"2026-08-31T21:17:54.677+00:00","url":"https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token"},{"cve":"CVE-2026-71479","cvss":9.1,"epss":0.0065,"slug":"cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controll","severity":"critical","exploited":false,"published_at":"2026-08-17T16:17:44.307+00:00","url":"https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing"},{"cve":"CVE-2026-64868","cvss":7.5,"epss":0.0064,"slug":"cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/str","severity":"high","exploited":false,"published_at":"2026-08-17T16:17:22.713+00:00","url":"https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of"},{"cve":"CVE-2026-64866","cvss":4,"epss":0.0047,"slug":"cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, Admi","severity":"medium","exploited":false,"published_at":"2026-08-17T16:17:22.57+00:00","url":"https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation"},{"cve":"CVE-2026-64865","cvss":4,"epss":0.003,"slug":"cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT","severity":"medium","exploited":false,"published_at":"2026-08-17T16:17:22.427+00:00","url":"https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user"},{"cve":"CVE-2026-64859","cvss":9.1,"epss":0.0063,"slug":"cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user","severity":"critical","exploited":false,"published_at":"2026-08-17T16:17:22.28+00:00","url":"https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege"},{"cve":"CVE-2026-44342","cvss":5.3,"epss":0.0019,"slug":"cve-2026-44342-quantumnous-new-api-csrf-in-account-binding-endpoints","title":"QuantumNous New API CSRF in account binding endpoints","severity":"medium","exploited":false,"published_at":"2026-07-09T23:17:05.217+00:00","url":"https://junglewise.ai/threats/cve-2026-44342-quantumnous-new-api-csrf-in-account-binding-endpoints"},{"cve":"CVE-2026-33655","cvss":7.7,"epss":0.0044,"slug":"cve-2026-33655-quantumnous-new-api-ssrf-via-unresolved-hostnames-in","title":"QuantumNous New API SSRF via unresolved hostnames in notifications","severity":"high","exploited":false,"published_at":"2026-07-09T23:17:04.763+00:00","url":"https://junglewise.ai/threats/cve-2026-33655-quantumnous-new-api-ssrf-via-unresolved-hostnames-in"},{"cve":"CVE-2026-9306","cvss":3.7,"epss":0.0003,"slug":"cve-2026-9306-quantumnous-new-api-authorization-bypass-in-midjourney-image-relay","title":"QuantumNous new-api authorization bypass in Midjourney Image Relay Endpoint","severity":"low","exploited":false,"published_at":"2026-05-23T16:19:46.86+00:00","url":"https://junglewise.ai/threats/cve-2026-9306-quantumnous-new-api-authorization-bypass-in-midjourney-image-relay"},{"cve":"CVE-2026-9305","cvss":6.3,"epss":0.0003,"slug":"cve-2026-9305-quantumnous-new-api-sql-injection-in-top-up-search-functions","title":"QuantumNous new-api SQL injection in top-up search functions","severity":"medium","exploited":false,"published_at":"2026-05-23T15:16:30.503+00:00","url":"https://junglewise.ai/threats/cve-2026-9305-quantumnous-new-api-sql-injection-in-top-up-search-functions"},{"cve":"CVE-2026-42339","cvss":7.1,"epss":0.003,"slug":"cve-2026-42339-quantumnous-new-api-ssrf-filter-bypass-via-0-0-0-0-address","title":"QuantumNous New API SSRF filter bypass via 0.0.0.0 address","severity":"high","exploited":false,"published_at":"2026-05-08T23:16:36.917+00:00","url":"https://junglewise.ai/threats/cve-2026-42339-quantumnous-new-api-ssrf-filter-bypass-via-0-0-0-0-address"},{"cve":"CVE-2026-41432","cvss":7.1,"epss":0.0075,"slug":"cve-2026-41432-quantumnous-new-api-signature-bypass-in-stripe-webhook-handler","title":"QuantumNous New API signature bypass in Stripe webhook handler","severity":"high","exploited":false,"published_at":"2026-05-08T23:16:35.457+00:00","url":"https://junglewise.ai/threats/cve-2026-41432-quantumnous-new-api-signature-bypass-in-stripe-webhook-handler"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":2,"exploited":0,"vulnerabilities":5},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"QuantumNous New API","slug":"new-api","vendor":{"name":"QuantumNous","slug":"quantumnous","url":"https://junglewise.ai/threats/vendors/quantumnous"},"aliases":[],"category":"service","url":"https://junglewise.ai/threats/technologies/new-api"},"most_severe":[{"cve":"CVE-2026-71479","cvss":9.1,"epss":0.0065,"slug":"cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controll","severity":"critical","exploited":false,"published_at":"2026-08-17T16:17:44.307+00:00","url":"https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing"},{"cve":"CVE-2026-64859","cvss":9.1,"epss":0.0063,"slug":"cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user","severity":"critical","exploited":false,"published_at":"2026-08-17T16:17:22.28+00:00","url":"https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege"},{"cve":"CVE-2026-33655","cvss":7.7,"epss":0.0044,"slug":"cve-2026-33655-quantumnous-new-api-ssrf-via-unresolved-hostnames-in","title":"QuantumNous New API SSRF via unresolved hostnames in notifications","severity":"high","exploited":false,"published_at":"2026-07-09T23:17:04.763+00:00","url":"https://junglewise.ai/threats/cve-2026-33655-quantumnous-new-api-ssrf-via-unresolved-hostnames-in"},{"cve":"CVE-2026-64868","cvss":7.5,"epss":0.0064,"slug":"cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/str","severity":"high","exploited":false,"published_at":"2026-08-17T16:17:22.713+00:00","url":"https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of"},{"cve":"CVE-2026-41432","cvss":7.1,"epss":0.0075,"slug":"cve-2026-41432-quantumnous-new-api-signature-bypass-in-stripe-webhook-handler","title":"QuantumNous New API signature bypass in Stripe webhook handler","severity":"high","exploited":false,"published_at":"2026-05-08T23:16:35.457+00:00","url":"https://junglewise.ai/threats/cve-2026-41432-quantumnous-new-api-signature-bypass-in-stripe-webhook-handler"},{"cve":"CVE-2026-42339","cvss":7.1,"epss":0.003,"slug":"cve-2026-42339-quantumnous-new-api-ssrf-filter-bypass-via-0-0-0-0-address","title":"QuantumNous New API SSRF filter bypass via 0.0.0.0 address","severity":"high","exploited":false,"published_at":"2026-05-08T23:16:36.917+00:00","url":"https://junglewise.ai/threats/cve-2026-42339-quantumnous-new-api-ssrf-filter-bypass-via-0-0-0-0-address"},{"cve":"CVE-2026-9305","cvss":6.3,"epss":0.0003,"slug":"cve-2026-9305-quantumnous-new-api-sql-injection-in-top-up-search-functions","title":"QuantumNous new-api SQL injection in top-up search functions","severity":"medium","exploited":false,"published_at":"2026-05-23T15:16:30.503+00:00","url":"https://junglewise.ai/threats/cve-2026-9305-quantumnous-new-api-sql-injection-in-top-up-search-functions"},{"cve":"CVE-2026-44342","cvss":5.3,"epss":0.0019,"slug":"cve-2026-44342-quantumnous-new-api-csrf-in-account-binding-endpoints","title":"QuantumNous New API CSRF in account binding endpoints","severity":"medium","exploited":false,"published_at":"2026-07-09T23:17:05.217+00:00","url":"https://junglewise.ai/threats/cve-2026-44342-quantumnous-new-api-csrf-in-account-binding-endpoints"},{"cve":"CVE-2026-82909","cvss":4.3,"epss":0.0039,"slug":"cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token","title":"QuantumNous new-api session expiration in Revoked API Token Handler","severity":"medium","exploited":false,"published_at":"2026-08-31T21:17:54.677+00:00","url":"https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token"},{"cve":"CVE-2026-64866","cvss":4,"epss":0.0047,"slug":"cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation","title":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, Admi","severity":"medium","exploited":false,"published_at":"2026-08-17T16:17:22.57+00:00","url":"https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation"}],"generated_at":"2026-09-26T16:07:00.132667+00:00"}