New API
9 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for New API. Use it to gauge the current risk picture and drill into individual advisories.
New API CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 1 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 2 |
| 2026-03 | 2 |
| 2026-04 | 0 |
| 2026-05 | 2 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 0 |
| 2026-10 | 0 |
Severity
How the 9 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High5
- Medium4
Latest CVEs
The 9 most recently published vulnerabilities affecting New API.
- CVE-2026-44342New API CSRF in email and WeChat account binding endpoints5.3
- CVE-2026-33655New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs7.7
- CVE-2026-42339New API: SSRF Filter Bypass via 0.0.0.07.1
- CVE-2026-41432New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud7.1
- CVE-2026-32879New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure4.9
- CVE-2026-30886New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check6.5
- CVE-2026-25802New API has Potential XSS in its MarkdownRenderer component7.6
- CVE-2026-25591New API has an SQL LIKE Wildcard Injection DoS via Token Search6.5
- CVE-2025-55573QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).8.8
Product grouping is registry-driven, with AI assist and human review. How it works