Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Quantumnous
New Api

QuantumNous/new-api: Functions Patched by CVE Fixes

go

javascript

#457 of 500 repositories

QuantumNous/new-api

Functions and files changed by CVE fixes in this repository.

Latest located fix August 31, 2026

13

CVE fixes located

Published CVEs

121

Functions patched

Distinct function sites

82

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in QuantumNous/new-api, the earliest published in 2025. Those fixes changed 121 distinct functions across 82 files, in 517 patch hunks.

Among the 500 repositories tracked here, QuantumNous/new-api ranks #457 by the number of CVEs with a located fix.

Most patched functions

Functions in QuantumNous/new-api changed by the most CVE fixes.

1SetApiRouterrouter/api-router.go5 CVEs · 6 patches2026
2updateVideoSingleTaskcontroller/task_video.go3 CVEs · 3 patches2026
3UpdateUsercontroller/user.go2 CVEs · 2 patches2026
4CacheUpdateChannelmodel/channel_cache.go2 CVEs · 2 patches2026
5GetUsercontroller/user.go2 CVEs · 2 patches2026
6canManageTargetRolecontroller/user.go2 CVEs · 2 patches2026
7AdminClearUserBindingcontroller/user.go2 CVEs · 2 patches2026
8ManageUsercontroller/user.go2 CVEs · 2 patches2026
9AdminResetPasskeycontroller/passkey.go2 CVEs · 2 patches2026
10LogJsonlogger/logger.go2 CVEs · 2 patches2026
11logHelperlogger/logger.go2 CVEs · 2 patches2026
12GetUserOAuthBindingsByAdmincontroller/custom_oauth.go2 CVEs · 2 patches2026
13UnbindCustomOAuthByAdmincontroller/custom_oauth.go2 CVEs · 2 patches2026
14AdminDisable2FAcontroller/twofa.go2 CVEs · 2 patches2026
15GetNextEnabledKeymodel/channel.go2 CVEs · 2 patches2026

Most patched files

Files in QuantumNous/new-api changed by the most CVE fixes.

1router/api-router.go5 CVEs · 1 functions
2controller/user.go4 CVEs · 8 functions
3model/user.go3 CVEs · 7 functions
4relay/channel/ali/image.go3 CVEs · 3 functions
5relay/mjproxy_handler.go3 CVEs · 2 functions
6controller/task_video.go3 CVEs · 1 functions
7relay/channel/api_request.go2 CVEs · 5 functions
8relay/helper/price.go2 CVEs · 3 functions
9controller/custom_oauth.go2 CVEs · 2 functions
10logger/logger.go2 CVEs · 2 functions

Fix size

How much code a CVE fix in QuantumNous/new-api changes, with backports counted once.

98

Median lines changed

Added plus removed, per CVE

15%

Fixes of 20 lines or fewer

Share of CVE fixes

15%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in QuantumNous/new-api, and the functions each fix changed.

QuantumNous new-api Revoked API Token token session expiration
CVE-2026-82909TokenAuthReadOnly
Medium · CVSS 5.3
EPSS 0.4%2026-08-31
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass
CVE-2026-64865updateUserCache UpdateUserSetting UpdateSelf
Medium · CVSS 6.0
EPSS 0.3%2026-08-17
New API: Integer overflow in quota billing yields negative charges (self-crediting)
CVE-2026-71479QuotaFromFloat validateTaskDurationBounds GetAndValidOpenAIImageRequest
Critical · CVSS 9.1
EPSS 0.6%2026-08-17
New API: Admin can reset passkeys for same-level or higher-privileged users
CVE-2026-64866StreamScannerHandler startPingKeepAlive updateVideoSingleTask
Medium · CVSS 5.1
EPSS 0.5%2026-08-17
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
CVE-2026-64868AnonymousRequestBodyLimit SetApiRouter GetAnonymousRequestBodyLimitBytes
High · CVSS 7.5
EPSS 0.6%2026-08-17
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
CVE-2026-64859StreamScannerHandler startPingKeepAlive updateVideoSingleTask
Critical · CVSS 9.1
EPSS 0.6%2026-08-17
New API CSRF in email and WeChat account binding endpoints
CVE-2026-44342SendPasswordResetEmail emailBindRequest WeChatBind
Medium · CVSS 5.3
EPSS 0.2%2026-07-09
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
CVE-2026-33655RelayMidjourneyImage VideoProxy init
High · CVSS 7.7
EPSS 0.4%2026-07-09
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
CVE-2026-30886VideoProxy
Medium · CVSS 6.5
EPSS 0.4%2026-03-23
New API has Potential XSS in its MarkdownRenderer component
CVE-2026-25802replace SandboxedHtmlPreview PreCode
High · CVSS 7.6
EPSS 0.3%2026-02-24
New API has an SQL LIKE Wildcard Injection DoS via Token Search
CVE-2026-25591SearchUserTokens userRateLimitFactory TokenSetting
High · CVSS 7.1
EPSS 0.7%2026-02-24
QuantumNous New API Has SSRF Bypass
CVE-2025-62155requestOpenAI2Perplexity ConvertClaudeRequest DoResponse
High · CVSS 8.5
EPSS 0.3%2025-11-24

Get an alert for each new QuantumNous/new-api CVE, with the patched functions and AI-written analysis.

Monitor new-api CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs caddyserver/caddy13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs craftcms/commerce13 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in QuantumNous/new-api.

How many CVEs have a located fix in QuantumNous/new-api?: 13 published CVEs have a fix traced to functions in QuantumNous/new-api, touching 121 functions across 82 files.
Which function in QuantumNous/new-api has been patched by the most CVEs?: SetApiRouter in router/api-router.go has been changed by 5 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in QuantumNous/new-api?: The median fix changes 98 lines. 15% of fixes change 20 lines or fewer, and 15% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

QuantumNous/new-api on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track QuantumNous/new-api CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References