newapi kayıtları
newapi üreticisine ait 9 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %66,7
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-918 Server-Side Request Forgery (SSRF)2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-287 Improper Authentication1
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic1
- CWE-639 Authorization Bypass Through User-Controlled Key1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
9 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
35İzleyin | CVE-2025-55573İstismar yok | QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).newapi · new api · CWE-79 | Yüksek8,8 | — | %0,4 | 22 Ağu 2025 |
32İzleyin | CVE-2026-41432Kavram kanıtı | New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraudnewapi · new api · CWE-345 | Yüksek8,2 | — | %0,8 | 8 May 2026 |
30İzleyin | CVE-2026-33655İstismar yok | New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLsnewapi · new api · CWE-918 | Yüksek7,7 | — | %0,4 | 9 Tem 2026 |
28İzleyin | CVE-2026-25591İstismar yok | New API has an SQL LIKE Wildcard Injection DoS via Token Searchnewapi · new api · CWE-943 | Yüksek7,1 | — | %0,6 | 23 Şub 2026 |
28İzleyin | CVE-2026-42339İstismar yok | New API: SSRF Filter Bypass via 0.0.0.0newapi · new api · CWE-918 | Yüksek7,1 | — | %0,3 | 8 May 2026 |
26İzleyin | CVE-2026-30886İstismar yok | New API: IDOR in VideoProxy allows cross-user video content access via missing ownership checknewapi · new api · CWE-639 | Orta6,5 | — | %0,4 | 23 Mar 2026 |
21İzleyin | CVE-2026-25802İstismar yok | New API has Potential XSS in its MarkdownRenderer componentnewapi · new api · CWE-79 | Orta5,4 | — | %0,3 | 23 Şub 2026 |
21İzleyin | CVE-2026-44342İstismar yok | New API CSRF in email and WeChat account binding endpointsnewapi · new api · CWE-352 | Orta5,3 | — | %0,2 | 9 Tem 2026 |
19İzleyin | CVE-2026-32879İstismar yok | New API has passkey-based secure step-up verification bypass for root-only channel secret disclosurenewapi · new api · CWE-287 | Orta4,9 | — | %0,5 | 23 Mar 2026 |
- CVE-2025-5557335İzleyin
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).
YüksekCVSS 8,8İstismar yokEPSS %0newapi · new api22 Ağu 2025
- CVE-2026-4143232İzleyin
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
YüksekCVSS 8,2Kavram kanıtıEPSS %1newapi · new api8 May 2026
- CVE-2026-3365530İzleyin
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
YüksekCVSS 7,7İstismar yokEPSS %0newapi · new api9 Tem 2026
- CVE-2026-2559128İzleyin
New API has an SQL LIKE Wildcard Injection DoS via Token Search
YüksekCVSS 7,1İstismar yokEPSS %1newapi · new api23 Şub 2026
- CVE-2026-4233928İzleyin
New API: SSRF Filter Bypass via 0.0.0.0
YüksekCVSS 7,1İstismar yokEPSS %0newapi · new api8 May 2026
- CVE-2026-3088626İzleyin
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
OrtaCVSS 6,5İstismar yokEPSS %0newapi · new api23 Mar 2026
- CVE-2026-2580221İzleyin
New API has Potential XSS in its MarkdownRenderer component
OrtaCVSS 5,4İstismar yokEPSS %0newapi · new api23 Şub 2026
- CVE-2026-4434221İzleyin
New API CSRF in email and WeChat account binding endpoints
OrtaCVSS 5,3İstismar yokEPSS %0newapi · new api9 Tem 2026
- CVE-2026-3287919İzleyin
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure
OrtaCVSS 4,9İstismar yokEPSS %0newapi · new api23 Mar 2026