Newapi New Api vulnerabilities

• newapi new api, quantumnous new-api +1 more New API CSRF in email and WeChat account binding endpoints CVE-2026-44342 Fix available 5.3 MediumJuly 7, 2026
• newapi new api, quantumnous new-api +1 more New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655 Fix available 7.7 HighJuly 7, 2026
• newapi new api, quantumnous new-api +1 more New API: SSRF Filter Bypass via 0.0.0.0 CVE-2026-42339 Fix available 7.1 HighMay 6, 2026
• newapi new api, quantumnous new-api +1 more New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVE-2026-41432 Fix available 7.1 HighApril 24, 2026
• newapi new api, quantumnous new-api +1 more New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure CVE-2026-32879 Fix available 4.9 MediumMarch 23, 2026
• newapi new api, quantumnous new-api +1 more New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVE-2026-30886 Fix available 6.5 MediumMarch 23, 2026
• newapi new api, quantumnous new-api +1 more New API has Potential XSS in its MarkdownRenderer component CVE-2026-25802 Fix available 7.6 HighFebruary 23, 2026
• newapi new api, quantumnous new-api +1 more New API has an SQL LIKE Wildcard Injection DoS via Token Search CVE-2026-25591 Fix available 7.1 HighFebruary 23, 2026
• newapi new api QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). CVE-2025-55573 8.8 HighAugust 22, 2025