Go to main page
Versions in this module
v1
Jul 7, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 7, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Sep 8, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Sep 7, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Sep 6, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Sep 5, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Sep 4, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Sep 3, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 31, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 30, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 30, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 29, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 26, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 18, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 7, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Aug 1, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 26, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 11, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 7, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 7, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 6, 2026 GO-2025-4154 +2 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
Jul 6, 2026 GO-2025-4154 +3 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
Jul 3, 2026 GO-2025-4154 +3 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
Jun 24, 2026 GO-2025-4154 +4 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
Jun 20, 2026 GO-2025-4154 +4 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
Jun 19, 2026 GO-2025-4154 +4 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
Jun 18, 2026 GO-2025-4154 +4 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
Jun 13, 2026 GO-2025-4154 +4 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
May 26, 2026 GO-2025-4154 +5 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 26, 2026 GO-2025-4154 +5 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 22, 2026 GO-2025-4154 +5 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 19, 2026 GO-2025-4154 +5 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 13, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 12, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 6, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
May 6, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 30, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 29, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 28, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
v0
Apr 27, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 24, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 25, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 24, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 22, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 17, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 17, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 17, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 16, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 15, 2026 GO-2025-4154 +7 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 13, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 12, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 12, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 9, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 8, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 8, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 7, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 6, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 2, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Apr 1, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 31, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 31, 2026 GO-2025-4154 +8 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 31, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 25, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 24, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 23, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 22, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 19, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 17, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 17, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 14, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 12, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 14, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 9, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 8, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 6, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 6, 2026 GO-2025-4154 +10 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 6, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 4, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 6, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 6, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 4, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 3, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 2, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 2, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 2, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 2, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Mar 1, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 28, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 28, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 28, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 25, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 24, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 24, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 23, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 23, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 22, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 22, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 22, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 22, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 22, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 22, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 20, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 12, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 11, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 10, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 8, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 8, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 7, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 7, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 6, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 6, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 6, 2026 GO-2025-4154 +11 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 6, 2026 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 5, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 4, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 4, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 4, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 3, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 3, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 3, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 3, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Feb 3, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 29, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 26, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 21, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 14, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 12, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 11, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 5, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 3, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 28, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Jan 2, 2026 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 30, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 29, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 26, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 25, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 21, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 20, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 13, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 13, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 13, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 12, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 12, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 12, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 12, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 11, 2025 GO-2025-4154 +13 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4813: New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 9, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 2, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 2, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Dec 1, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 30, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 30, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 30, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 23, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 20, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 20, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 16, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 18, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 14, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 11, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 12, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 11, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 10, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 7, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 6, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 3, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 5, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 31, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Nov 1, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 31, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 29, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 30, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 29, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 29, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 29, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 28, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 18, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 15, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 17, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 16, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 16, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 15, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 15, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 15, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 15, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 14, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 14, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 12, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 13, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
Oct 12, 2025 GO-2025-4154 +12 more
GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api
GO-2026-4531: New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api
GO-2026-4532: New API has Potential XSS in its MarkdownRenderer component in github.com/QuantumNous/new-api
GO-2026-4814: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api
GO-2026-5652: QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
GO-2026-5753: New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
GO-2026-5929: New API is vulnerable to CSRF through user email binding in github.com/QuantumNous/new-api
GO-2026-5930: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api
GO-2026-6240: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
GO-2026-6242: New API: Integer overflow in quota billing yields negative charges (self-crediting) in github.com/QuantumNous/new-api
GO-2026-6243: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
GO-2026-6244: New API: Admin can reset passkeys for same-level or higher-privileged users in github.com/QuantumNous/new-api
GO-2026-6245: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api